Moderate: python27:2.7 security and bug fix update
Summary
ALSA-2021:1761: Moderate: python27:2.7 security and bug fix update. Affects python-psycopg2-doc versions < 2.7.5-7.module_el8.6.0+2781+fed64c13. Fixed in 2.7.5-7.module_el8.6.0+2781+fed64c13. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic data types, and dynamic typing. The python27 packages provide a stable release of Python 2.7 with a number of additional utilities and database connectors for MySQL and PostgreSQL.
Vulnerability Detail
This vulnerability (CVE-2020-26116) allows for CRLF injection via the HTTP request method in httplib/http.client. Another vulnerability (CVE-2020-26137) enables CRLF injection via the HTTP request method in python-urllib3. Additionally, python-lxml is susceptible to mXSS due to the use of an improper parser (CVE-2020-27783). Lastly, there is a stack-based buffer overflow in PyCArg_repr in _ctypes/callproc.c (CVE-2021-3177). These vulnerabilities can potentially lead to various security issues and should be addressed promptly.
How To Fix
Minimum fixed version
2.7.5-7.module_el8.6.0+2781+fed64c13
This is the first release that contains the fix.
sudo dnf update python-psycopg2-docTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, it is important to update the python27 package to address the identified vulnerabilities. Failure to do so may expose your system to potential security risks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python-psycopg2-doc →
FAQ
Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic data types, and dynamic typing.
These vulnerabilities can lead to various security issues, including CRLF injection and mXSS attacks.
To fix these vulnerabilities, update the python27 package to version 2.7.5-7.module_el8.6.0+2781+fed64c13 or later.
No specific workarounds have been mentioned for these vulnerabilities.
You can find more information about these vulnerabilities in the CVE pages listed in the References section.
Related vulnerabilities
Recent vulnerabilities recorded for python-psycopg2-doc.
