Security update for python310 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:3473-1 Final 1 1 2022-09-30T08:33:59Z current 2022-09-30T08:33:59Z 2022-09-30T08:33:59Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for python310 This update for python310 fixes the following issues: Updated to version 3.10.7: - CVE-2020-10735: Fixed DoS due to missing limit of amount of digits when converting text to int (bsc#1203125). - CVE-2021-28861: Fixed an open redirect in the http server when an URI path starts with // (bsc#1202624). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container bci/python:3-2022-3473,SUSE-2022-3473,SUSE-SLE-Module-Python3-15-SP4-2022-3473,openSUSE-SLE-15.4-2022-3473 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20223473-1/ Link for SUSE-SU-2022:3473-1 https://lists.suse.com/pipermail/sle-security-updates/2022-September/012460.html E-Mail link for SUSE-SU-2022:3473-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1202624 SUSE Bug 1202624 https://bugzilla.suse.com/1203125 SUSE Bug 1203125 https://www.suse.com/security/cve/CVE-2020-10735/ SUSE CVE CVE-2020-10735 page https://www.suse.com/security/cve/CVE-2021-28861/ SUSE CVE CVE-2021-28861 page Container bci/python:3 SUSE Linux Enterprise Module for Python 3 15 SP4 openSUSE Leap 15.4 libpython3_10-1_0-3.10.7-150400.4.10.1 python310-3.10.7-150400.4.10.1 python310-base-3.10.7-150400.4.10.1 python310-devel-3.10.7-150400.4.10.1 libpython3_10-1_0-32bit-3.10.7-150400.4.10.1 libpython3_10-1_0-64bit-3.10.7-150400.4.10.1 python310-32bit-3.10.7-150400.4.10.1 python310-64bit-3.10.7-150400.4.10.1 python310-base-32bit-3.10.7-150400.4.10.1 python310-base-64bit-3.10.7-150400.4.10.1 python310-curses-3.10.7-150400.4.10.1 python310-dbm-3.10.7-150400.4.10.1 python310-doc-3.10.7-150400.4.10.1 python310-doc-devhelp-3.10.7-150400.4.10.1 python310-idle-3.10.7-150400.4.10.1 python310-testsuite-3.10.7-150400.4.10.1 python310-tk-3.10.7-150400.4.10.1 python310-tools-3.10.7-150400.4.10.1 libpython3_10-1_0-3.10.7-150400.4.10.1 as a component of Container bci/python:3 python310-3.10.7-150400.4.10.1 as a component of Container bci/python:3 python310-base-3.10.7-150400.4.10.1 as a component of Container bci/python:3 python310-devel-3.10.7-150400.4.10.1 as a component of Container bci/python:3 libpython3_10-1_0-3.10.7-150400.4.10.1 as a component of SUSE Linux Enterprise Module for Python 3 15 SP4 python310-3.10.7-150400.4.10.1 as a component of SUSE Linux Enterprise Module for Python 3 15 SP4 python310-base-3.10.7-150400.4.10.1 as a component of SUSE Linux Enterprise Module for Python 3 15 SP4 python310-curses-3.10.7-150400.4.10.1 as a component of SUSE Linux Enterprise Module for Python 3 15 SP4 python310-dbm-3.10.7-150400.4.10.1 as a component of SUSE Linux Enterprise Module for Python 3 15 SP4 python310-devel-3.10.7-150400.4.10.1 as a component of SUSE Linux Enterprise Module for Python 3 15 SP4 python310-idle-3.10.7-150400.4.10.1 as a component of SUSE Linux Enterprise Module for Python 3 15 SP4 python310-tk-3.10.7-150400.4.10.1 as a component of SUSE Linux Enterprise Module for Python 3 15 SP4 python310-tools-3.10.7-150400.4.10.1 as a component of SUSE Linux Enterprise Module for Python 3 15 SP4 libpython3_10-1_0-3.10.7-150400.4.10.1 as a component of openSUSE Leap 15.4 libpython3_10-1_0-32bit-3.10.7-150400.4.10.1 as a component of openSUSE Leap 15.4 python310-3.10.7-150400.4.10.1 as a component of openSUSE Leap 15.4 python310-32bit-3.10.7-150400.4.10.1 as a component of openSUSE Leap 15.4 python310-base-3.10.7-150400.4.10.1 as a component of openSUSE Leap 15.4 python310-base-32bit-3.10.7-150400.4.10.1 as a component of openSUSE Leap 15.4 python310-curses-3.10.7-150400.4.10.1 as a component of openSUSE Leap 15.4 python310-dbm-3.10.7-150400.4.10.1 as a component of openSUSE Leap 15.4 python310-devel-3.10.7-150400.4.10.1 as a component of openSUSE Leap 15.4 python310-doc-3.10.7-150400.4.10.1 as a component of openSUSE Leap 15.4 python310-doc-devhelp-3.10.7-150400.4.10.1 as a component of openSUSE Leap 15.4 python310-idle-3.10.7-150400.4.10.1 as a component of openSUSE Leap 15.4 python310-testsuite-3.10.7-150400.4.10.1 as a component of openSUSE Leap 15.4 python310-tk-3.10.7-150400.4.10.1 as a component of openSUSE Leap 15.4 python310-tools-3.10.7-150400.4.10.1 as a component of openSUSE Leap 15.4 A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability. CVE-2020-10735 Container bci/python:3:libpython3_10-1_0-3.10.7-150400.4.10.1 Container bci/python:3:python310-3.10.7-150400.4.10.1 Container bci/python:3:python310-base-3.10.7-150400.4.10.1 Container bci/python:3:python310-devel-3.10.7-150400.4.10.1 SUSE Linux Enterprise Module for Python 3 15 SP4:libpython3_10-1_0-3.10.7-150400.4.10.1 SUSE Linux Enterprise Module for Python 3 15 SP4:python310-3.10.7-150400.4.10.1 SUSE Linux Enterprise Module for Python 3 15 SP4:python310-base-3.10.7-150400.4.10.1 SUSE Linux Enterprise Module for Python 3 15 SP4:python310-curses-3.10.7-150400.4.10.1 SUSE Linux Enterprise Module for Python 3 15 SP4:python310-dbm-3.10.7-150400.4.10.1 SUSE Linux Enterprise Module for Python 3 15 SP4:python310-devel-3.10.7-150400.4.10.1 SUSE Linux Enterprise Module for Python 3 15 SP4:python310-idle-3.10.7-150400.4.10.1 SUSE Linux Enterprise Module for Python 3 15 SP4:python310-tk-3.10.7-150400.4.10.1 SUSE Linux Enterprise Module for Python 3 15 SP4:python310-tools-3.10.7-150400.4.10.1 openSUSE Leap 15.4:libpython3_10-1_0-3.10.7-150400.4.10.1 openSUSE Leap 15.4:libpython3_10-1_0-32bit-3.10.7-150400.4.10.1 openSUSE Leap 15.4:python310-3.10.7-150400.4.10.1 openSUSE Leap 15.4:python310-32bit-3.10.7-150400.4.10.1 openSUSE Leap 15.4:python310-base-3.10.7-150400.4.10.1 openSUSE Leap 15.4:python310-base-32bit-3.10.7-150400.4.10.1 openSUSE Leap 15.4:python310-curses-3.10.7-150400.4.10.1 openSUSE Leap 15.4:python310-dbm-3.10.7-150400.4.10.1 openSUSE Leap 15.4:python310-devel-3.10.7-150400.4.10.1 openSUSE Leap 15.4:python310-doc-3.10.7-150400.4.10.1 openSUSE Leap 15.4:python310-doc-devhelp-3.10.7-150400.4.10.1 openSUSE Leap 15.4:python310-idle-3.10.7-150400.4.10.1 openSUSE Leap 15.4:python310-testsuite-3.10.7-150400.4.10.1 openSUSE Leap 15.4:python310-tk-3.10.7-150400.4.10.1 openSUSE Leap 15.4:python310-tools-3.10.7-150400.4.10.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20223473-1/ https://www.suse.com/security/cve/CVE-2020-10735.html CVE-2020-10735 https://bugzilla.suse.com/1203125 SUSE Bug 1203125 https://bugzilla.suse.com/1204077 SUSE Bug 1204077 https://bugzilla.suse.com/1204096 SUSE Bug 1204096 https://bugzilla.suse.com/1204097 SUSE Bug 1204097 https://bugzilla.suse.com/1205075 SUSE Bug 1205075 https://bugzilla.suse.com/1208131 SUSE Bug 1208131 ** DISPUTED ** Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states "Warning: http.server is not recommended for production. It only implements basic security checks." CVE-2021-28861 Container bci/python:3:libpython3_10-1_0-3.10.7-150400.4.10.1 Container bci/python:3:python310-3.10.7-150400.4.10.1 Container bci/python:3:python310-base-3.10.7-150400.4.10.1 Container bci/python:3:python310-devel-3.10.7-150400.4.10.1 SUSE Linux Enterprise Module for Python 3 15 SP4:libpython3_10-1_0-3.10.7-150400.4.10.1 SUSE Linux Enterprise Module for Python 3 15 SP4:python310-3.10.7-150400.4.10.1 SUSE Linux Enterprise Module for Python 3 15 SP4:python310-base-3.10.7-150400.4.10.1 SUSE Linux Enterprise Module for Python 3 15 SP4:python310-curses-3.10.7-150400.4.10.1 SUSE Linux Enterprise Module for Python 3 15 SP4:python310-dbm-3.10.7-150400.4.10.1 SUSE Linux Enterprise Module for Python 3 15 SP4:python310-devel-3.10.7-150400.4.10.1 SUSE Linux Enterprise Module for Python 3 15 SP4:python310-idle-3.10.7-150400.4.10.1 SUSE Linux Enterprise Module for Python 3 15 SP4:python310-tk-3.10.7-150400.4.10.1 SUSE Linux Enterprise Module for Python 3 15 SP4:python310-tools-3.10.7-150400.4.10.1 openSUSE Leap 15.4:libpython3_10-1_0-3.10.7-150400.4.10.1 openSUSE Leap 15.4:libpython3_10-1_0-32bit-3.10.7-150400.4.10.1 openSUSE Leap 15.4:python310-3.10.7-150400.4.10.1 openSUSE Leap 15.4:python310-32bit-3.10.7-150400.4.10.1 openSUSE Leap 15.4:python310-base-3.10.7-150400.4.10.1 openSUSE Leap 15.4:python310-base-32bit-3.10.7-150400.4.10.1 openSUSE Leap 15.4:python310-curses-3.10.7-150400.4.10.1 openSUSE Leap 15.4:python310-dbm-3.10.7-150400.4.10.1 openSUSE Leap 15.4:python310-devel-3.10.7-150400.4.10.1 openSUSE Leap 15.4:python310-doc-3.10.7-150400.4.10.1 openSUSE Leap 15.4:python310-doc-devhelp-3.10.7-150400.4.10.1 openSUSE Leap 15.4:python310-idle-3.10.7-150400.4.10.1 openSUSE Leap 15.4:python310-testsuite-3.10.7-150400.4.10.1 openSUSE Leap 15.4:python310-tk-3.10.7-150400.4.10.1 openSUSE Leap 15.4:python310-tools-3.10.7-150400.4.10.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20223473-1/ https://www.suse.com/security/cve/CVE-2021-28861.html CVE-2021-28861 https://bugzilla.suse.com/1202624 SUSE Bug 1202624 https://bugzilla.suse.com/1204077 SUSE Bug 1204077 https://bugzilla.suse.com/1204801 SUSE Bug 1204801 https://bugzilla.suse.com/1204802 SUSE Bug 1204802 https://bugzilla.suse.com/1205068 SUSE Bug 1205068 https://bugzilla.suse.com/1205075 SUSE Bug 1205075 https://bugzilla.suse.com/1205467 SUSE Bug 1205467