openSUSE-SU-2021:4104-1
See a problem?- Import Source
- https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2021:4104-1.json
- JSON Data
- https://api.osv.dev/v1/vulns/openSUSE-SU-2021:4104-1
- Related
- Published
- 2021-12-16T10:14:25Z
- Modified
- 2021-12-16T10:14:25Z
- Summary
- Security update for python3
- Details
-
This update for python3 fixes the following issues:
- CVE-2021-3426: Fixed information disclosure via pydoc (bsc#1183374).
- CVE-2021-3733: Fixed infinitely reading potential HTTP headers after a 100 Continue status response from the server (bsc#1189241).
CVE-2021-3737: Fixed ReDoS in urllib.request (bsc#1189287).
We do not require python-rpm-macros package (bsc#1180125).
- Use versioned python-Sphinx to avoid dependency on other version of Python (bsc#1183858).
- Stop providing 'python' symbol, which means python2 currently (bsc#1185588).
- Modify Lib/ensurepip/init.py to contain the same version numbers as are in reality the ones in the bundled wheels (bsc#1187668).
- References
-
- https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KYXM7YGLJSNOU4FYI3M2QXACCQ4SO3AE/
- https://bugzilla.suse.com/1180125
- https://bugzilla.suse.com/1183374
- https://bugzilla.suse.com/1183858
- https://bugzilla.suse.com/1185588
- https://bugzilla.suse.com/1187668
- https://bugzilla.suse.com/1189241
- https://bugzilla.suse.com/1189287
- https://www.suse.com/security/cve/CVE-2021-3426
- https://www.suse.com/security/cve/CVE-2021-3733
- https://www.suse.com/security/cve/CVE-2021-3737
Affected packages
openSUSE:Leap 15.3 / python3
Package
- Name
- python3
- Purl
- pkg:rpm/opensuse/python3&distro=openSUSE%20Leap%2015.3
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed3.6.15-10.9.1
Ecosystem specific
{
"binaries": [
{
"python3": "3.6.15-10.9.1",
"python3-idle": "3.6.15-10.9.1",
"python3-tk": "3.6.15-10.9.1",
"python3-testsuite": "3.6.15-10.9.1",
"python3-dbm": "3.6.15-10.9.1",
"python3-curses": "3.6.15-10.9.1",
"python3-doc-devhelp": "3.6.15-10.9.1",
"libpython3_6m1_0-32bit": "3.6.15-10.9.1",
"python3-doc": "3.6.15-10.9.1",
"python3-tools": "3.6.15-10.9.1",
"libpython3_6m1_0": "3.6.15-10.9.1",
"python3-devel": "3.6.15-10.9.1",
"python3-base": "3.6.15-10.9.1"
}
]
}
openSUSE:Leap 15.3 / python3-core
Package
- Name
- python3-core
- Purl
- pkg:rpm/opensuse/python3-core&distro=openSUSE%20Leap%2015.3
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed3.6.15-10.9.1
Ecosystem specific
{
"binaries": [
{
"python3": "3.6.15-10.9.1",
"python3-idle": "3.6.15-10.9.1",
"python3-tk": "3.6.15-10.9.1",
"python3-testsuite": "3.6.15-10.9.1",
"python3-dbm": "3.6.15-10.9.1",
"python3-curses": "3.6.15-10.9.1",
"python3-doc-devhelp": "3.6.15-10.9.1",
"libpython3_6m1_0-32bit": "3.6.15-10.9.1",
"python3-doc": "3.6.15-10.9.1",
"python3-tools": "3.6.15-10.9.1",
"libpython3_6m1_0": "3.6.15-10.9.1",
"python3-devel": "3.6.15-10.9.1",
"python3-base": "3.6.15-10.9.1"
}
]
}
openSUSE:Leap 15.3 / python3-documentation
Package
- Name
- python3-documentation
- Purl
- pkg:rpm/opensuse/python3-documentation&distro=openSUSE%20Leap%2015.3
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed3.6.15-10.9.1
Ecosystem specific
{
"binaries": [
{
"python3": "3.6.15-10.9.1",
"python3-idle": "3.6.15-10.9.1",
"python3-tk": "3.6.15-10.9.1",
"python3-testsuite": "3.6.15-10.9.1",
"python3-dbm": "3.6.15-10.9.1",
"python3-curses": "3.6.15-10.9.1",
"python3-doc-devhelp": "3.6.15-10.9.1",
"libpython3_6m1_0-32bit": "3.6.15-10.9.1",
"python3-doc": "3.6.15-10.9.1",
"python3-tools": "3.6.15-10.9.1",
"libpython3_6m1_0": "3.6.15-10.9.1",
"python3-devel": "3.6.15-10.9.1",
"python3-base": "3.6.15-10.9.1"
}
]
}