ID

VAR-202109-1966

CVE

CVE-2021-3733

TITLE

Python Software Foundation  of  Python  Vulnerability related to resource exhaustion in products of multiple vendors

DESCRIPTION

There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability. Python Software Foundation of Python Products from other vendors have resource exhaustion vulnerabilities.Service operation interruption (DoS) It may be in a state. Python is an open source, object-oriented programming language developed by the Python Foundation. The language is scalable, supports modules and packages, and supports multiple platforms. A code issue vulnerability exists in Python due to a failure in the product to properly handle RCFS. An attacker could exploit this vulnerability to cause a denial of service. The following products and versions are affected: python3.5 For Ubuntu 16.04 ESM. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: python38:3.8 and python38-devel:3.8 security update Advisory ID: RHSA-2022:1764-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2022:1764 Issue date: 2022-05-10 CVE Names: CVE-2021-3733 CVE-2021-3737 CVE-2021-43818 CVE-2022-0391 ===================================================================== 1. Summary: An update for the python38:3.8 and python38-devel:3.8 modules is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat CodeReady Linux Builder (v. 8) - noarch Red Hat Enterprise Linux AppStream (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64 3. Description: Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. The following packages have been upgraded to a later upstream version: python38 (3.8), python38-devel (3.8). (BZ#1997680, BZ#1997860) Security Fix(es): * python: urllib: Regular expression DoS in AbstractBasicAuthHandler (CVE-2021-3733) * python-lxml: HTML Cleaner allows crafted and SVG embedded scripts to pass through (CVE-2021-43818) * python: urllib.parse does not sanitize URLs containing ASCII newline and tabs (CVE-2022-0391) * python: urllib: HTTP client possible infinite loop on a 100 Continue response (CVE-2021-3737) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.6 Release Notes linked from the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1995162 - CVE-2021-3737 python: urllib: HTTP client possible infinite loop on a 100 Continue response 1995234 - CVE-2021-3733 python: urllib: Regular expression DoS in AbstractBasicAuthHandler 2004587 - Update the python interpreter to the latest security release 3.8.12 2006789 - RHEL 8 Python 3.8: pip contains bundled pre-built exe files in site-packages/pip/_vendor/distlib/ 2032569 - CVE-2021-43818 python-lxml: HTML Cleaner allows crafted and SVG embedded scripts to pass through 2047376 - CVE-2022-0391 python: urllib.parse does not sanitize URLs containing ASCII newline and tabs 6. Package List: Red Hat Enterprise Linux AppStream (v. 8): Source: Cython-0.29.14-4.module+el8.4.0+8888+89bc7e79.src.rpm PyYAML-5.4.1-1.module+el8.5.0+10721+14d8e0d5.src.rpm babel-2.7.0-11.module+el8.5.0+11015+9c1c7c42.src.rpm mod_wsgi-4.6.8-3.module+el8.4.0+8888+89bc7e79.src.rpm numpy-1.17.3-6.module+el8.5.0+12205+a865257a.src.rpm python-PyMySQL-0.10.1-1.module+el8.4.0+9692+8e86ab84.src.rpm python-asn1crypto-1.2.0-3.module+el8.4.0+8888+89bc7e79.src.rpm python-cffi-1.13.2-3.module+el8.4.0+8888+89bc7e79.src.rpm python-chardet-3.0.4-19.module+el8.4.0+8888+89bc7e79.src.rpm python-cryptography-2.8-3.module+el8.4.0+8888+89bc7e79.src.rpm python-idna-2.8-6.module+el8.4.0+8888+89bc7e79.src.rpm python-jinja2-2.10.3-5.module+el8.5.0+10542+ba057329.src.rpm python-lxml-4.4.1-7.module+el8.6.0+13958+214a5473.src.rpm python-markupsafe-1.1.1-6.module+el8.4.0+8888+89bc7e79.src.rpm python-ply-3.11-10.module+el8.4.0+9579+e9717e18.src.rpm python-psutil-5.6.4-4.module+el8.5.0+12031+10ce4870.src.rpm python-psycopg2-2.8.4-4.module+el8.4.0+8888+89bc7e79.src.rpm python-pycparser-2.19-3.module+el8.4.0+8888+89bc7e79.src.rpm python-pysocks-1.7.1-4.module+el8.4.0+8888+89bc7e79.src.rpm python-requests-2.22.0-9.module+el8.4.0+8888+89bc7e79.src.rpm python-urllib3-1.25.7-5.module+el8.5.0+11639+ea5b349d.src.rpm python-wheel-0.33.6-6.module+el8.5.0+12205+a865257a.src.rpm python38-3.8.12-1.module+el8.6.0+12642+c3710b74.src.rpm python3x-pip-19.3.1-5.module+el8.6.0+13002+70cfc74a.src.rpm python3x-setuptools-41.6.0-5.module+el8.5.0+12205+a865257a.src.rpm python3x-six-1.12.0-10.module+el8.4.0+8888+89bc7e79.src.rpm pytz-2019.3-3.module+el8.4.0+8888+89bc7e79.src.rpm scipy-1.3.1-4.module+el8.4.0+8888+89bc7e79.src.rpm aarch64: Cython-debugsource-0.29.14-4.module+el8.4.0+8888+89bc7e79.aarch64.rpm PyYAML-debugsource-5.4.1-1.module+el8.5.0+10721+14d8e0d5.aarch64.rpm numpy-debugsource-1.17.3-6.module+el8.5.0+12205+a865257a.aarch64.rpm python-cffi-debugsource-1.13.2-3.module+el8.4.0+8888+89bc7e79.aarch64.rpm python-cryptography-debugsource-2.8-3.module+el8.4.0+8888+89bc7e79.aarch64.rpm python-lxml-debugsource-4.4.1-7.module+el8.6.0+13958+214a5473.aarch64.rpm python-markupsafe-debugsource-1.1.1-6.module+el8.4.0+8888+89bc7e79.aarch64.rpm python-psutil-debugsource-5.6.4-4.module+el8.5.0+12031+10ce4870.aarch64.rpm python-psycopg2-debugsource-2.8.4-4.module+el8.4.0+8888+89bc7e79.aarch64.rpm python38-3.8.12-1.module+el8.6.0+12642+c3710b74.aarch64.rpm python38-Cython-0.29.14-4.module+el8.4.0+8888+89bc7e79.aarch64.rpm python38-Cython-debuginfo-0.29.14-4.module+el8.4.0+8888+89bc7e79.aarch64.rpm python38-cffi-1.13.2-3.module+el8.4.0+8888+89bc7e79.aarch64.rpm python38-cffi-debuginfo-1.13.2-3.module+el8.4.0+8888+89bc7e79.aarch64.rpm python38-cryptography-2.8-3.module+el8.4.0+8888+89bc7e79.aarch64.rpm python38-cryptography-debuginfo-2.8-3.module+el8.4.0+8888+89bc7e79.aarch64.rpm python38-debug-3.8.12-1.module+el8.6.0+12642+c3710b74.aarch64.rpm python38-debuginfo-3.8.12-1.module+el8.6.0+12642+c3710b74.aarch64.rpm python38-debugsource-3.8.12-1.module+el8.6.0+12642+c3710b74.aarch64.rpm python38-devel-3.8.12-1.module+el8.6.0+12642+c3710b74.aarch64.rpm python38-idle-3.8.12-1.module+el8.6.0+12642+c3710b74.aarch64.rpm python38-libs-3.8.12-1.module+el8.6.0+12642+c3710b74.aarch64.rpm python38-lxml-4.4.1-7.module+el8.6.0+13958+214a5473.aarch64.rpm python38-lxml-debuginfo-4.4.1-7.module+el8.6.0+13958+214a5473.aarch64.rpm python38-markupsafe-1.1.1-6.module+el8.4.0+8888+89bc7e79.aarch64.rpm python38-markupsafe-debuginfo-1.1.1-6.module+el8.4.0+8888+89bc7e79.aarch64.rpm python38-mod_wsgi-4.6.8-3.module+el8.4.0+8888+89bc7e79.aarch64.rpm python38-numpy-1.17.3-6.module+el8.5.0+12205+a865257a.aarch64.rpm python38-numpy-debuginfo-1.17.3-6.module+el8.5.0+12205+a865257a.aarch64.rpm python38-numpy-f2py-1.17.3-6.module+el8.5.0+12205+a865257a.aarch64.rpm python38-psutil-5.6.4-4.module+el8.5.0+12031+10ce4870.aarch64.rpm python38-psutil-debuginfo-5.6.4-4.module+el8.5.0+12031+10ce4870.aarch64.rpm python38-psycopg2-2.8.4-4.module+el8.4.0+8888+89bc7e79.aarch64.rpm python38-psycopg2-debuginfo-2.8.4-4.module+el8.4.0+8888+89bc7e79.aarch64.rpm python38-psycopg2-doc-2.8.4-4.module+el8.4.0+8888+89bc7e79.aarch64.rpm python38-psycopg2-tests-2.8.4-4.module+el8.4.0+8888+89bc7e79.aarch64.rpm python38-pyyaml-5.4.1-1.module+el8.5.0+10721+14d8e0d5.aarch64.rpm python38-pyyaml-debuginfo-5.4.1-1.module+el8.5.0+10721+14d8e0d5.aarch64.rpm python38-scipy-1.3.1-4.module+el8.4.0+8888+89bc7e79.aarch64.rpm python38-scipy-debuginfo-1.3.1-4.module+el8.4.0+8888+89bc7e79.aarch64.rpm python38-test-3.8.12-1.module+el8.6.0+12642+c3710b74.aarch64.rpm python38-tkinter-3.8.12-1.module+el8.6.0+12642+c3710b74.aarch64.rpm scipy-debugsource-1.3.1-4.module+el8.4.0+8888+89bc7e79.aarch64.rpm noarch: python38-PyMySQL-0.10.1-1.module+el8.4.0+9692+8e86ab84.noarch.rpm python38-asn1crypto-1.2.0-3.module+el8.4.0+8888+89bc7e79.noarch.rpm python38-babel-2.7.0-11.module+el8.5.0+11015+9c1c7c42.noarch.rpm python38-chardet-3.0.4-19.module+el8.4.0+8888+89bc7e79.noarch.rpm python38-idna-2.8-6.module+el8.4.0+8888+89bc7e79.noarch.rpm python38-jinja2-2.10.3-5.module+el8.5.0+10542+ba057329.noarch.rpm python38-numpy-doc-1.17.3-6.module+el8.5.0+12205+a865257a.noarch.rpm python38-pip-19.3.1-5.module+el8.6.0+13002+70cfc74a.noarch.rpm python38-pip-wheel-19.3.1-5.module+el8.6.0+13002+70cfc74a.noarch.rpm python38-ply-3.11-10.module+el8.4.0+9579+e9717e18.noarch.rpm python38-pycparser-2.19-3.module+el8.4.0+8888+89bc7e79.noarch.rpm python38-pysocks-1.7.1-4.module+el8.4.0+8888+89bc7e79.noarch.rpm python38-pytz-2019.3-3.module+el8.4.0+8888+89bc7e79.noarch.rpm python38-requests-2.22.0-9.module+el8.4.0+8888+89bc7e79.noarch.rpm python38-rpm-macros-3.8.12-1.module+el8.6.0+12642+c3710b74.noarch.rpm python38-setuptools-41.6.0-5.module+el8.5.0+12205+a865257a.noarch.rpm python38-setuptools-wheel-41.6.0-5.module+el8.5.0+12205+a865257a.noarch.rpm python38-six-1.12.0-10.module+el8.4.0+8888+89bc7e79.noarch.rpm python38-urllib3-1.25.7-5.module+el8.5.0+11639+ea5b349d.noarch.rpm python38-wheel-0.33.6-6.module+el8.5.0+12205+a865257a.noarch.rpm python38-wheel-wheel-0.33.6-6.module+el8.5.0+12205+a865257a.noarch.rpm ppc64le: Cython-debugsource-0.29.14-4.module+el8.4.0+8888+89bc7e79.ppc64le.rpm PyYAML-debugsource-5.4.1-1.module+el8.5.0+10721+14d8e0d5.ppc64le.rpm numpy-debugsource-1.17.3-6.module+el8.5.0+12205+a865257a.ppc64le.rpm python-cffi-debugsource-1.13.2-3.module+el8.4.0+8888+89bc7e79.ppc64le.rpm python-cryptography-debugsource-2.8-3.module+el8.4.0+8888+89bc7e79.ppc64le.rpm python-lxml-debugsource-4.4.1-7.module+el8.6.0+13958+214a5473.ppc64le.rpm python-markupsafe-debugsource-1.1.1-6.module+el8.4.0+8888+89bc7e79.ppc64le.rpm python-psutil-debugsource-5.6.4-4.module+el8.5.0+12031+10ce4870.ppc64le.rpm python-psycopg2-debugsource-2.8.4-4.module+el8.4.0+8888+89bc7e79.ppc64le.rpm python38-3.8.12-1.module+el8.6.0+12642+c3710b74.ppc64le.rpm python38-Cython-0.29.14-4.module+el8.4.0+8888+89bc7e79.ppc64le.rpm python38-Cython-debuginfo-0.29.14-4.module+el8.4.0+8888+89bc7e79.ppc64le.rpm python38-cffi-1.13.2-3.module+el8.4.0+8888+89bc7e79.ppc64le.rpm python38-cffi-debuginfo-1.13.2-3.module+el8.4.0+8888+89bc7e79.ppc64le.rpm python38-cryptography-2.8-3.module+el8.4.0+8888+89bc7e79.ppc64le.rpm python38-cryptography-debuginfo-2.8-3.module+el8.4.0+8888+89bc7e79.ppc64le.rpm python38-debug-3.8.12-1.module+el8.6.0+12642+c3710b74.ppc64le.rpm python38-debuginfo-3.8.12-1.module+el8.6.0+12642+c3710b74.ppc64le.rpm python38-debugsource-3.8.12-1.module+el8.6.0+12642+c3710b74.ppc64le.rpm python38-devel-3.8.12-1.module+el8.6.0+12642+c3710b74.ppc64le.rpm python38-idle-3.8.12-1.module+el8.6.0+12642+c3710b74.ppc64le.rpm python38-libs-3.8.12-1.module+el8.6.0+12642+c3710b74.ppc64le.rpm python38-lxml-4.4.1-7.module+el8.6.0+13958+214a5473.ppc64le.rpm python38-lxml-debuginfo-4.4.1-7.module+el8.6.0+13958+214a5473.ppc64le.rpm python38-markupsafe-1.1.1-6.module+el8.4.0+8888+89bc7e79.ppc64le.rpm python38-markupsafe-debuginfo-1.1.1-6.module+el8.4.0+8888+89bc7e79.ppc64le.rpm python38-mod_wsgi-4.6.8-3.module+el8.4.0+8888+89bc7e79.ppc64le.rpm python38-numpy-1.17.3-6.module+el8.5.0+12205+a865257a.ppc64le.rpm python38-numpy-debuginfo-1.17.3-6.module+el8.5.0+12205+a865257a.ppc64le.rpm python38-numpy-f2py-1.17.3-6.module+el8.5.0+12205+a865257a.ppc64le.rpm python38-psutil-5.6.4-4.module+el8.5.0+12031+10ce4870.ppc64le.rpm python38-psutil-debuginfo-5.6.4-4.module+el8.5.0+12031+10ce4870.ppc64le.rpm python38-psycopg2-2.8.4-4.module+el8.4.0+8888+89bc7e79.ppc64le.rpm python38-psycopg2-debuginfo-2.8.4-4.module+el8.4.0+8888+89bc7e79.ppc64le.rpm python38-psycopg2-doc-2.8.4-4.module+el8.4.0+8888+89bc7e79.ppc64le.rpm python38-psycopg2-tests-2.8.4-4.module+el8.4.0+8888+89bc7e79.ppc64le.rpm python38-pyyaml-5.4.1-1.module+el8.5.0+10721+14d8e0d5.ppc64le.rpm python38-pyyaml-debuginfo-5.4.1-1.module+el8.5.0+10721+14d8e0d5.ppc64le.rpm python38-scipy-1.3.1-4.module+el8.4.0+8888+89bc7e79.ppc64le.rpm python38-scipy-debuginfo-1.3.1-4.module+el8.4.0+8888+89bc7e79.ppc64le.rpm python38-test-3.8.12-1.module+el8.6.0+12642+c3710b74.ppc64le.rpm python38-tkinter-3.8.12-1.module+el8.6.0+12642+c3710b74.ppc64le.rpm scipy-debugsource-1.3.1-4.module+el8.4.0+8888+89bc7e79.ppc64le.rpm s390x: Cython-debugsource-0.29.14-4.module+el8.4.0+8888+89bc7e79.s390x.rpm PyYAML-debugsource-5.4.1-1.module+el8.5.0+10721+14d8e0d5.s390x.rpm numpy-debugsource-1.17.3-6.module+el8.5.0+12205+a865257a.s390x.rpm python-cffi-debugsource-1.13.2-3.module+el8.4.0+8888+89bc7e79.s390x.rpm python-cryptography-debugsource-2.8-3.module+el8.4.0+8888+89bc7e79.s390x.rpm python-lxml-debugsource-4.4.1-7.module+el8.6.0+13958+214a5473.s390x.rpm python-markupsafe-debugsource-1.1.1-6.module+el8.4.0+8888+89bc7e79.s390x.rpm python-psutil-debugsource-5.6.4-4.module+el8.5.0+12031+10ce4870.s390x.rpm python-psycopg2-debugsource-2.8.4-4.module+el8.4.0+8888+89bc7e79.s390x.rpm python38-3.8.12-1.module+el8.6.0+12642+c3710b74.s390x.rpm python38-Cython-0.29.14-4.module+el8.4.0+8888+89bc7e79.s390x.rpm python38-Cython-debuginfo-0.29.14-4.module+el8.4.0+8888+89bc7e79.s390x.rpm python38-cffi-1.13.2-3.module+el8.4.0+8888+89bc7e79.s390x.rpm python38-cffi-debuginfo-1.13.2-3.module+el8.4.0+8888+89bc7e79.s390x.rpm python38-cryptography-2.8-3.module+el8.4.0+8888+89bc7e79.s390x.rpm python38-cryptography-debuginfo-2.8-3.module+el8.4.0+8888+89bc7e79.s390x.rpm python38-debug-3.8.12-1.module+el8.6.0+12642+c3710b74.s390x.rpm python38-debuginfo-3.8.12-1.module+el8.6.0+12642+c3710b74.s390x.rpm python38-debugsource-3.8.12-1.module+el8.6.0+12642+c3710b74.s390x.rpm python38-devel-3.8.12-1.module+el8.6.0+12642+c3710b74.s390x.rpm python38-idle-3.8.12-1.module+el8.6.0+12642+c3710b74.s390x.rpm python38-libs-3.8.12-1.module+el8.6.0+12642+c3710b74.s390x.rpm python38-lxml-4.4.1-7.module+el8.6.0+13958+214a5473.s390x.rpm python38-lxml-debuginfo-4.4.1-7.module+el8.6.0+13958+214a5473.s390x.rpm python38-markupsafe-1.1.1-6.module+el8.4.0+8888+89bc7e79.s390x.rpm python38-markupsafe-debuginfo-1.1.1-6.module+el8.4.0+8888+89bc7e79.s390x.rpm python38-mod_wsgi-4.6.8-3.module+el8.4.0+8888+89bc7e79.s390x.rpm python38-numpy-1.17.3-6.module+el8.5.0+12205+a865257a.s390x.rpm python38-numpy-debuginfo-1.17.3-6.module+el8.5.0+12205+a865257a.s390x.rpm python38-numpy-f2py-1.17.3-6.module+el8.5.0+12205+a865257a.s390x.rpm python38-psutil-5.6.4-4.module+el8.5.0+12031+10ce4870.s390x.rpm python38-psutil-debuginfo-5.6.4-4.module+el8.5.0+12031+10ce4870.s390x.rpm python38-psycopg2-2.8.4-4.module+el8.4.0+8888+89bc7e79.s390x.rpm python38-psycopg2-debuginfo-2.8.4-4.module+el8.4.0+8888+89bc7e79.s390x.rpm python38-psycopg2-doc-2.8.4-4.module+el8.4.0+8888+89bc7e79.s390x.rpm python38-psycopg2-tests-2.8.4-4.module+el8.4.0+8888+89bc7e79.s390x.rpm python38-pyyaml-5.4.1-1.module+el8.5.0+10721+14d8e0d5.s390x.rpm python38-pyyaml-debuginfo-5.4.1-1.module+el8.5.0+10721+14d8e0d5.s390x.rpm python38-scipy-1.3.1-4.module+el8.4.0+8888+89bc7e79.s390x.rpm python38-scipy-debuginfo-1.3.1-4.module+el8.4.0+8888+89bc7e79.s390x.rpm python38-test-3.8.12-1.module+el8.6.0+12642+c3710b74.s390x.rpm python38-tkinter-3.8.12-1.module+el8.6.0+12642+c3710b74.s390x.rpm scipy-debugsource-1.3.1-4.module+el8.4.0+8888+89bc7e79.s390x.rpm x86_64: Cython-debugsource-0.29.14-4.module+el8.4.0+8888+89bc7e79.x86_64.rpm PyYAML-debugsource-5.4.1-1.module+el8.5.0+10721+14d8e0d5.x86_64.rpm numpy-debugsource-1.17.3-6.module+el8.5.0+12205+a865257a.x86_64.rpm python-cffi-debugsource-1.13.2-3.module+el8.4.0+8888+89bc7e79.x86_64.rpm python-cryptography-debugsource-2.8-3.module+el8.4.0+8888+89bc7e79.x86_64.rpm python-lxml-debugsource-4.4.1-7.module+el8.6.0+13958+214a5473.x86_64.rpm python-markupsafe-debugsource-1.1.1-6.module+el8.4.0+8888+89bc7e79.x86_64.rpm python-psutil-debugsource-5.6.4-4.module+el8.5.0+12031+10ce4870.x86_64.rpm python-psycopg2-debugsource-2.8.4-4.module+el8.4.0+8888+89bc7e79.x86_64.rpm python38-3.8.12-1.module+el8.6.0+12642+c3710b74.x86_64.rpm python38-Cython-0.29.14-4.module+el8.4.0+8888+89bc7e79.x86_64.rpm python38-Cython-debuginfo-0.29.14-4.module+el8.4.0+8888+89bc7e79.x86_64.rpm python38-cffi-1.13.2-3.module+el8.4.0+8888+89bc7e79.x86_64.rpm python38-cffi-debuginfo-1.13.2-3.module+el8.4.0+8888+89bc7e79.x86_64.rpm python38-cryptography-2.8-3.module+el8.4.0+8888+89bc7e79.x86_64.rpm python38-cryptography-debuginfo-2.8-3.module+el8.4.0+8888+89bc7e79.x86_64.rpm python38-debug-3.8.12-1.module+el8.6.0+12642+c3710b74.x86_64.rpm python38-debuginfo-3.8.12-1.module+el8.6.0+12642+c3710b74.x86_64.rpm python38-debugsource-3.8.12-1.module+el8.6.0+12642+c3710b74.x86_64.rpm python38-devel-3.8.12-1.module+el8.6.0+12642+c3710b74.x86_64.rpm python38-idle-3.8.12-1.module+el8.6.0+12642+c3710b74.x86_64.rpm python38-libs-3.8.12-1.module+el8.6.0+12642+c3710b74.x86_64.rpm python38-lxml-4.4.1-7.module+el8.6.0+13958+214a5473.x86_64.rpm python38-lxml-debuginfo-4.4.1-7.module+el8.6.0+13958+214a5473.x86_64.rpm python38-markupsafe-1.1.1-6.module+el8.4.0+8888+89bc7e79.x86_64.rpm python38-markupsafe-debuginfo-1.1.1-6.module+el8.4.0+8888+89bc7e79.x86_64.rpm python38-mod_wsgi-4.6.8-3.module+el8.4.0+8888+89bc7e79.x86_64.rpm python38-numpy-1.17.3-6.module+el8.5.0+12205+a865257a.x86_64.rpm python38-numpy-debuginfo-1.17.3-6.module+el8.5.0+12205+a865257a.x86_64.rpm python38-numpy-f2py-1.17.3-6.module+el8.5.0+12205+a865257a.x86_64.rpm python38-psutil-5.6.4-4.module+el8.5.0+12031+10ce4870.x86_64.rpm python38-psutil-debuginfo-5.6.4-4.module+el8.5.0+12031+10ce4870.x86_64.rpm python38-psycopg2-2.8.4-4.module+el8.4.0+8888+89bc7e79.x86_64.rpm python38-psycopg2-debuginfo-2.8.4-4.module+el8.4.0+8888+89bc7e79.x86_64.rpm python38-psycopg2-doc-2.8.4-4.module+el8.4.0+8888+89bc7e79.x86_64.rpm python38-psycopg2-tests-2.8.4-4.module+el8.4.0+8888+89bc7e79.x86_64.rpm python38-pyyaml-5.4.1-1.module+el8.5.0+10721+14d8e0d5.x86_64.rpm python38-pyyaml-debuginfo-5.4.1-1.module+el8.5.0+10721+14d8e0d5.x86_64.rpm python38-scipy-1.3.1-4.module+el8.4.0+8888+89bc7e79.x86_64.rpm python38-scipy-debuginfo-1.3.1-4.module+el8.4.0+8888+89bc7e79.x86_64.rpm python38-test-3.8.12-1.module+el8.6.0+12642+c3710b74.x86_64.rpm python38-tkinter-3.8.12-1.module+el8.6.0+12642+c3710b74.x86_64.rpm scipy-debugsource-1.3.1-4.module+el8.4.0+8888+89bc7e79.x86_64.rpm Red Hat CodeReady Linux Builder (v. 8): Source: pytest-4.6.6-3.module+el8.4.0+8888+89bc7e79.src.rpm python-atomicwrites-1.3.0-8.module+el8.4.0+8888+89bc7e79.src.rpm python-attrs-19.3.0-3.module+el8.4.0+8888+89bc7e79.src.rpm python-more-itertools-7.2.0-5.module+el8.4.0+8888+89bc7e79.src.rpm python-packaging-19.2-3.module+el8.4.0+8888+89bc7e79.src.rpm python-pluggy-0.13.0-3.module+el8.4.0+8888+89bc7e79.src.rpm python-py-1.8.0-8.module+el8.4.0+8888+89bc7e79.src.rpm python-wcwidth-0.1.7-16.module+el8.4.0+8888+89bc7e79.src.rpm python3x-pyparsing-2.4.5-3.module+el8.4.0+8888+89bc7e79.src.rpm noarch: python38-atomicwrites-1.3.0-8.module+el8.4.0+8888+89bc7e79.noarch.rpm python38-attrs-19.3.0-3.module+el8.4.0+8888+89bc7e79.noarch.rpm python38-more-itertools-7.2.0-5.module+el8.4.0+8888+89bc7e79.noarch.rpm python38-packaging-19.2-3.module+el8.4.0+8888+89bc7e79.noarch.rpm python38-pluggy-0.13.0-3.module+el8.4.0+8888+89bc7e79.noarch.rpm python38-py-1.8.0-8.module+el8.4.0+8888+89bc7e79.noarch.rpm python38-pyparsing-2.4.5-3.module+el8.4.0+8888+89bc7e79.noarch.rpm python38-pytest-4.6.6-3.module+el8.4.0+8888+89bc7e79.noarch.rpm python38-wcwidth-0.1.7-16.module+el8.4.0+8888+89bc7e79.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2021-3733 https://access.redhat.com/security/cve/CVE-2021-3737 https://access.redhat.com/security/cve/CVE-2021-43818 https://access.redhat.com/security/cve/CVE-2022-0391 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.6_release_notes/ 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYnqQbtzjgjWX9erEAQgnnBAAim+GuSrydBbxi0s4w6LR+l5XTnTzDmkl Zq12+m7sT8mq0veWvias08iivuoOeN0ibSMx5yymrD0RJe+kS1PbJ9xyfDAaDiN9 K6wOPJhvVuzDJRgrkuI80ABZR9MLQCb8Csb/RepkkGtko/kGRzRnIqe7q53LNi8z 5o6eSrC1+96J1J+CmB8jAUeZPwFeX9B3bq2Fc20I9uhgg3H9lT0dD0ovc4G/u+/3 oRbJLpQdg9zBweMIfxiilHyeaOYLuok8bQ2OU0fglZVasX4pb6R4NLg99fAbbhpe WX/oZel5cwo9CvkdD8v4CDUqT8I0xlOpOoemd4Mwg/yo8ITTt16lWNxxkY0kPH6K oj6hvkv/akPO+CTFqHqKOvrUKvbmyFhtehic+7RkWcPNpKrXtHihcuyScWRkxG5J mCev5DDmvw7rGoYiDl7gPEzBm6b/xxROMYtwfONiDaphmbQm9eimdJ5sYJ4+Zfu2 0aqPoJ1ARZUNlhuYTW2sa9yoE1v8RIHtppCmgblEEGNv/Nh5pFiDktfaOLbF4X37 D+dQfyiICf3FHo6LzGIY4B6w3T7FtezMOZSThzwYnq5I1qexlyL/Ug9TwHtA6ez+ 0OwkzfjbktW7lzRvij47/YIl2LvOteQutYa8xbiADZVSPkYNAnh0B7EZ/+reGra6 CNbxA3ArPQc= =3Ugn -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce . ========================================================================== Ubuntu Security Notice USN-5200-1 December 17, 2021 python3.7, python3.8 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 18.04 LTS Summary: Python could be made to crash if it receives specially crafted input from a malicious server. (CVE-2020-8492) It was discovered that the urllib.request.AbstractBasicAuthHandler class in Python contains regex with a quadratic worst-case time complexity. (CVE-2021-3733) It was discovered that the Python urllib http client could enter into an infinite loop when incorrectly handling certain server responses (100 Continue response). (CVE-2021-3737) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 18.04 LTS: libpython3.7-stdlib 3.7.5-2ubuntu1~18.04.2 libpython3.8-stdlib 3.8.0-3ubuntu1~18.04.2 python3.7 3.7.5-2ubuntu1~18.04.2 python3.7-minimal 3.7.5-2ubuntu1~18.04.2 python3.8 3.8.0-3ubuntu1~18.04.2 python3.8-minimal 3.8.0-3ubuntu1~18.04.2 In general, a standard system update will make all the necessary changes. See the following Release Notes documentation, which will be updated shortly for this release, for additional details about this release: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.2/html/release_notes/ Security fixes: * CVE-2021-3795 semver-regex: inefficient regular expression complexity * CVE-2021-23440 nodejs-set-value: type confusion allows bypass of CVE-2019-10747 Related bugs: * RHACM 2.2.10 images (Bugzilla #2013652) 3. Bugs fixed (https://bugzilla.redhat.com/): 2004944 - CVE-2021-23440 nodejs-set-value: type confusion allows bypass of CVE-2019-10747 2006009 - CVE-2021-3795 semver-regex: inefficient regular expression complexity 2013652 - RHACM 2.2.10 images 5. Summary: The Migration Toolkit for Containers (MTC) 1.5.2 is now available. Description: The Migration Toolkit for Containers (MTC) enables you to migrate Kubernetes resources, persistent volume data, and internal container images between OpenShift Container Platform clusters, using the MTC web console or the Kubernetes API. Bugs fixed (https://bugzilla.redhat.com/): 2000734 - CVE-2021-3757 nodejs-immer: prototype pollution may lead to DoS or remote code execution 2005438 - Combining Rsync and Stunnel in a single pod can degrade performance (1.5 backport) 2006842 - MigCluster CR remains in "unready" state and source registry is inaccessible after temporary shutdown of source cluster 2007429 - "oc describe" and "oc log" commands on "Migration resources" tree cannot be copied after failed migration 2022017 - CVE-2021-3948 mig-controller: incorrect namespaces handling may lead to not authorized usage of Migration Toolkit for Containers (MTC) 5. Summary: Red Hat Advanced Cluster Management for Kubernetes 2.4.0 General Availability release images, which fix several bugs and security issues. Description: Red Hat Advanced Cluster Management for Kubernetes 2.4.0 images Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. See the following Release Notes documentation, which will be updated shortly for this release, for additional details about this release: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_mana gement_for_kubernetes/2.4/html/release_notes/ Security fixes: * CVE-2021-33623: nodejs-trim-newlines: ReDoS in .end() method * CVE-2021-32626: redis: Lua scripts can overflow the heap-based Lua stack * CVE-2021-32627: redis: Integer overflow issue with Streams * CVE-2021-32628: redis: Integer overflow bug in the ziplist data structure * CVE-2021-32672: redis: Out of bounds read in lua debugger protocol parser * CVE-2021-32675: redis: Denial of service via Redis Standard Protocol (RESP) request * CVE-2021-32687: redis: Integer overflow issue with intsets * CVE-2021-32690: helm: information disclosure vulnerability * CVE-2021-32803: nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite * CVE-2021-32804: nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite * CVE-2021-23017: nginx: Off-by-one in ngx_resolver_copy() when labels are followed by a pointer to a root domain name * CVE-2021-3711: openssl: SM2 Decryption Buffer Overflow * CVE-2021-3712: openssl: Read buffer overruns processing ASN.1 strings * CVE-2021-3749: nodejs-axios: Regular expression denial of service in trim function * CVE-2021-41099: redis: Integer overflow issue with strings Bug fixes: * RFE ACM Application management UI doesn't reflect object status (Bugzilla #1965321) * RHACM 2.4 files (Bugzilla #1983663) * Hive Operator CrashLoopBackOff when deploying ACM with latest downstream 2.4 (Bugzilla #1993366) * submariner-addon pod failing in RHACM 2.4 latest ds snapshot (Bugzilla #1994668) * ACM 2.4 install on OCP 4.9 ipv6 disconnected hub fails due to multicluster pod in clb (Bugzilla #2000274) * pre-network-manager-config failed due to timeout when static config is used (Bugzilla #2003915) * InfraEnv condition does not reflect the actual error message (Bugzilla #2009204, 2010030) * Flaky test point to a nil pointer conditions list (Bugzilla #2010175) * InfraEnv status shows 'Failed to create image: internal error (Bugzilla #2010272) * subctl diagnose firewall intra-cluster - failed VXLAN checks (Bugzilla #2013157) * pre-network-manager-config failed due to timeout when static config is used (Bugzilla #2014084) 3. Bugs fixed (https://bugzilla.redhat.com/): 1963121 - CVE-2021-23017 nginx: Off-by-one in ngx_resolver_copy() when labels are followed by a pointer to a root domain name 1965321 - RFE ACM Application management UI doesn't reflect object status 1966615 - CVE-2021-33623 nodejs-trim-newlines: ReDoS in .end() method 1978144 - CVE-2021-32690 helm: information disclosure vulnerability 1983663 - RHACM 2.4.0 images 1990409 - CVE-2021-32804 nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite 1990415 - CVE-2021-32803 nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite 1993366 - Hive Operator CrashLoopBackOff when deploying ACM with latest downstream 2.4 1994668 - submariner-addon pod failing in RHACM 2.4 latest ds snapshot 1995623 - CVE-2021-3711 openssl: SM2 Decryption Buffer Overflow 1995634 - CVE-2021-3712 openssl: Read buffer overruns processing ASN.1 strings 1999784 - CVE-2021-3749 nodejs-axios: Regular expression denial of service in trim function 2000274 - ACM 2.4 install on OCP 4.9 ipv6 disconnected hub fails due to multicluster pod in clb 2003915 - pre-network-manager-config failed due to timeout when static config is used 2009204 - InfraEnv condition does not reflect the actual error message 2010030 - InfraEnv condition does not reflect the actual error message 2010175 - Flaky test point to a nil pointer conditions list 2010272 - InfraEnv status shows 'Failed to create image: internal error 2010991 - CVE-2021-32687 redis: Integer overflow issue with intsets 2011000 - CVE-2021-32675 redis: Denial of service via Redis Standard Protocol (RESP) request 2011001 - CVE-2021-32672 redis: Out of bounds read in lua debugger protocol parser 2011004 - CVE-2021-32628 redis: Integer overflow bug in the ziplist data structure 2011010 - CVE-2021-32627 redis: Integer overflow issue with Streams 2011017 - CVE-2021-32626 redis: Lua scripts can overflow the heap-based Lua stack 2011020 - CVE-2021-41099 redis: Integer overflow issue with strings 2013157 - subctl diagnose firewall intra-cluster - failed VXLAN checks 2014084 - pre-network-manager-config failed due to timeout when static config is used 5. Description: Red Hat OpenShift Serverless release of the OpenShift Serverless Operator. Security Fix(es): * golang: net/http/httputil: panic due to racy read of persistConn after handler panic (CVE-2021-36221) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution: See the Red Hat OpenShift Container Platform 4.6 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless/index See the Red Hat OpenShift Container Platform 4.7 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/serverless/index See the Red Hat OpenShift Container Platform 4.8 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.8/html/serverless/index See the Red Hat OpenShift Container Platform 4.9 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.9/html/serverless/index 4. Bugs fixed (https://bugzilla.redhat.com/): 1995656 - CVE-2021-36221 golang: net/http/httputil: panic due to racy read of persistConn after handler panic 2016256 - Release of OpenShift Serverless Eventing 1.19.0 2016258 - Release of OpenShift Serverless Serving 1.19.0 5. Bugs fixed (https://bugzilla.redhat.com/): 1983596 - CVE-2021-34558 golang: crypto/tls: certificate of wrong type is causing TLS client to panic 1992006 - CVE-2021-29923 golang: net: incorrect parsing of extraneous zero characters at the beginning of an IP address octet 1998844 - virt-handler Pod is missing xorrisofs command 2008522 - "unable to execute QEMU agent command 'guest-get-users'" logs in virt-launcher pod every 10 seconds 2010334 - VM is not able to be migrated after failed migration 2012328 - 2.6.8 containers 2013494 - [CNV-2.6.8] VMI is in LiveMigrate loop when Upgrading Cluster from 2.6.7/4.7.32 to OCP 4.8.13 5

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

TYPE

bypass

EXTERNAL IDS

REFERENCES

CREDITS

Red Hat

SOURCES

LAST UPDATE DATE

2025-08-12T22:30:46.242000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE