Security update for python SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:4001-1 Final 1 1 2023-10-06T13:13:32Z current 2023-10-06T13:13:32Z 2023-10-06T13:13:32Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for python This update for python fixes the following issues: - CVE-2022-48566: Constant-time-defeating optimisations were possible in the accumulator variable in hmac.compare_digest. (bsc#1214691) - CVE-2022-48565: Fixed an XXE in the plistlib module. (bsc#1214685) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2023-4001,SUSE-SLE-SERVER-12-SP5-2023-4001,SUSE-SLE-WE-12-SP5-2023-4001 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20234001-1/ Link for SUSE-SU-2023:4001-1 https://lists.suse.com/pipermail/sle-security-updates/2023-October/016561.html E-Mail link for SUSE-SU-2023:4001-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1214685 SUSE Bug 1214685 https://bugzilla.suse.com/1214691 SUSE Bug 1214691 https://www.suse.com/security/cve/CVE-2022-48565/ SUSE CVE CVE-2022-48565 page https://www.suse.com/security/cve/CVE-2022-48566/ SUSE CVE CVE-2022-48566 page SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Workstation Extension 12 SP5 libpython2_7-1_0-2.7.18-33.26.1 libpython2_7-1_0-32bit-2.7.18-33.26.1 libpython2_7-1_0-64bit-2.7.18-33.26.1 python-2.7.18-33.26.1 python-32bit-2.7.18-33.26.1 python-64bit-2.7.18-33.26.1 python-base-2.7.18-33.26.1 python-base-32bit-2.7.18-33.26.1 python-base-64bit-2.7.18-33.26.1 python-curses-2.7.18-33.26.1 python-demo-2.7.18-33.26.1 python-devel-2.7.18-33.26.1 python-doc-2.7.18-33.26.1 python-doc-pdf-2.7.18-33.26.1 python-gdbm-2.7.18-33.26.1 python-idle-2.7.18-33.26.1 python-strict-tls-check-2.7.18-33.26.1 python-tk-2.7.18-33.26.1 python-xml-2.7.18-33.26.1 libpython2_7-1_0-2.7.18-33.26.1 as a component of SUSE Linux Enterprise Server 12 SP5 libpython2_7-1_0-32bit-2.7.18-33.26.1 as a component of SUSE Linux Enterprise Server 12 SP5 python-2.7.18-33.26.1 as a component of SUSE Linux Enterprise Server 12 SP5 python-32bit-2.7.18-33.26.1 as a component of SUSE Linux Enterprise Server 12 SP5 python-base-2.7.18-33.26.1 as a component of SUSE Linux Enterprise Server 12 SP5 python-base-32bit-2.7.18-33.26.1 as a component of SUSE Linux Enterprise Server 12 SP5 python-curses-2.7.18-33.26.1 as a component of SUSE Linux Enterprise Server 12 SP5 python-demo-2.7.18-33.26.1 as a component of SUSE Linux Enterprise Server 12 SP5 python-devel-2.7.18-33.26.1 as a component of SUSE Linux Enterprise Server 12 SP5 python-doc-2.7.18-33.26.1 as a component of SUSE Linux Enterprise Server 12 SP5 python-doc-pdf-2.7.18-33.26.1 as a component of SUSE Linux Enterprise Server 12 SP5 python-gdbm-2.7.18-33.26.1 as a component of SUSE Linux Enterprise Server 12 SP5 python-idle-2.7.18-33.26.1 as a component of SUSE Linux Enterprise Server 12 SP5 python-tk-2.7.18-33.26.1 as a component of SUSE Linux Enterprise Server 12 SP5 python-xml-2.7.18-33.26.1 as a component of SUSE Linux Enterprise Server 12 SP5 libpython2_7-1_0-2.7.18-33.26.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libpython2_7-1_0-32bit-2.7.18-33.26.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 python-2.7.18-33.26.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 python-32bit-2.7.18-33.26.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 python-base-2.7.18-33.26.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 python-base-32bit-2.7.18-33.26.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 python-curses-2.7.18-33.26.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 python-demo-2.7.18-33.26.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 python-devel-2.7.18-33.26.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 python-doc-2.7.18-33.26.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 python-doc-pdf-2.7.18-33.26.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 python-gdbm-2.7.18-33.26.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 python-idle-2.7.18-33.26.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 python-tk-2.7.18-33.26.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 python-xml-2.7.18-33.26.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 python-devel-2.7.18-33.26.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5 An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities. CVE-2022-48565 SUSE Linux Enterprise Server 12 SP5:libpython2_7-1_0-2.7.18-33.26.1 SUSE Linux Enterprise Server 12 SP5:libpython2_7-1_0-32bit-2.7.18-33.26.1 SUSE Linux Enterprise Server 12 SP5:python-2.7.18-33.26.1 SUSE Linux Enterprise Server 12 SP5:python-32bit-2.7.18-33.26.1 SUSE Linux Enterprise Server 12 SP5:python-base-2.7.18-33.26.1 SUSE Linux Enterprise Server 12 SP5:python-base-32bit-2.7.18-33.26.1 SUSE Linux Enterprise Server 12 SP5:python-curses-2.7.18-33.26.1 SUSE Linux Enterprise Server 12 SP5:python-demo-2.7.18-33.26.1 SUSE Linux Enterprise Server 12 SP5:python-devel-2.7.18-33.26.1 SUSE Linux Enterprise Server 12 SP5:python-doc-2.7.18-33.26.1 SUSE Linux Enterprise Server 12 SP5:python-doc-pdf-2.7.18-33.26.1 SUSE Linux Enterprise Server 12 SP5:python-gdbm-2.7.18-33.26.1 SUSE Linux Enterprise Server 12 SP5:python-idle-2.7.18-33.26.1 SUSE Linux Enterprise Server 12 SP5:python-tk-2.7.18-33.26.1 SUSE Linux Enterprise Server 12 SP5:python-xml-2.7.18-33.26.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpython2_7-1_0-2.7.18-33.26.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpython2_7-1_0-32bit-2.7.18-33.26.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python-2.7.18-33.26.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python-32bit-2.7.18-33.26.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python-base-2.7.18-33.26.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python-base-32bit-2.7.18-33.26.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python-curses-2.7.18-33.26.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python-demo-2.7.18-33.26.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python-devel-2.7.18-33.26.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python-doc-2.7.18-33.26.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python-doc-pdf-2.7.18-33.26.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python-gdbm-2.7.18-33.26.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python-idle-2.7.18-33.26.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python-tk-2.7.18-33.26.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python-xml-2.7.18-33.26.1 SUSE Linux Enterprise Workstation Extension 12 SP5:python-devel-2.7.18-33.26.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20234001-1/ https://www.suse.com/security/cve/CVE-2022-48565.html CVE-2022-48565 https://bugzilla.suse.com/1214685 SUSE Bug 1214685 An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possible in the accumulator variable in hmac.compare_digest. CVE-2022-48566 SUSE Linux Enterprise Server 12 SP5:libpython2_7-1_0-2.7.18-33.26.1 SUSE Linux Enterprise Server 12 SP5:libpython2_7-1_0-32bit-2.7.18-33.26.1 SUSE Linux Enterprise Server 12 SP5:python-2.7.18-33.26.1 SUSE Linux Enterprise Server 12 SP5:python-32bit-2.7.18-33.26.1 SUSE Linux Enterprise Server 12 SP5:python-base-2.7.18-33.26.1 SUSE Linux Enterprise Server 12 SP5:python-base-32bit-2.7.18-33.26.1 SUSE Linux Enterprise Server 12 SP5:python-curses-2.7.18-33.26.1 SUSE Linux Enterprise Server 12 SP5:python-demo-2.7.18-33.26.1 SUSE Linux Enterprise Server 12 SP5:python-devel-2.7.18-33.26.1 SUSE Linux Enterprise Server 12 SP5:python-doc-2.7.18-33.26.1 SUSE Linux Enterprise Server 12 SP5:python-doc-pdf-2.7.18-33.26.1 SUSE Linux Enterprise Server 12 SP5:python-gdbm-2.7.18-33.26.1 SUSE Linux Enterprise Server 12 SP5:python-idle-2.7.18-33.26.1 SUSE Linux Enterprise Server 12 SP5:python-tk-2.7.18-33.26.1 SUSE Linux Enterprise Server 12 SP5:python-xml-2.7.18-33.26.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpython2_7-1_0-2.7.18-33.26.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpython2_7-1_0-32bit-2.7.18-33.26.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python-2.7.18-33.26.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python-32bit-2.7.18-33.26.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python-base-2.7.18-33.26.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python-base-32bit-2.7.18-33.26.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python-curses-2.7.18-33.26.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python-demo-2.7.18-33.26.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python-devel-2.7.18-33.26.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python-doc-2.7.18-33.26.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python-doc-pdf-2.7.18-33.26.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python-gdbm-2.7.18-33.26.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python-idle-2.7.18-33.26.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python-tk-2.7.18-33.26.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python-xml-2.7.18-33.26.1 SUSE Linux Enterprise Workstation Extension 12 SP5:python-devel-2.7.18-33.26.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20234001-1/ https://www.suse.com/security/cve/CVE-2022-48566.html CVE-2022-48566 https://bugzilla.suse.com/1214691 SUSE Bug 1214691