diff options
author | 2021-01-24 18:59:53 -0500 | |
---|---|---|
committer | 2021-01-24 18:59:53 -0500 | |
commit | 95b428c9d2c8af177d047f297e888a0188d3ecf2 (patch) | |
tree | f39c1d2a6409250354b92df096bb8cd3fe4855c7 /glsa-202101-18.xml | |
parent | [ GLSA 202101-17 ] Dnsmasq: Multiple vulnerabilities (diff) | |
download | glsa-95b428c9d2c8af177d047f297e888a0188d3ecf2.tar.gz glsa-95b428c9d2c8af177d047f297e888a0188d3ecf2.tar.bz2 glsa-95b428c9d2c8af177d047f297e888a0188d3ecf2.zip |
[ GLSA 202101-18 ] Python: Multiple vulnerabilities
Signed-off-by: Aaron Bauman <bman@gentoo.org>
Diffstat (limited to 'glsa-202101-18.xml')
-rw-r--r-- | glsa-202101-18.xml | 90 |
1 files changed, 90 insertions, 0 deletions
diff --git a/glsa-202101-18.xml b/glsa-202101-18.xml new file mode 100644 index 00000000..03d6e27b --- /dev/null +++ b/glsa-202101-18.xml @@ -0,0 +1,90 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd"> +<glsa id="202101-18"> + <title>Python: Multiple vulnerabilities</title> + <synopsis>Multiple vulnerabilities have been found in Python, the worst of + which could result in the arbitrary execution of code. + </synopsis> + <product type="ebuild">python</product> + <announced>2021-01-24</announced> + <revised count="1">2021-01-24</revised> + <bug>749339</bug> + <bug>759928</bug> + <bug>766189</bug> + <access>remote</access> + <affected> + <package name="dev-lang/python" auto="yes" arch="*"> + <unaffected range="ge" slot="2.7">2.7.18-r6</unaffected> + <unaffected range="ge" slot="3.6">3.6.12-r2</unaffected> + <unaffected range="ge" slot="3.7">3.7.9-r2</unaffected> + <unaffected range="ge" slot="3.8">3.8.7-r1</unaffected> + <unaffected range="ge" slot="3.9">3.9.1-r1</unaffected> + <vulnerable range="lt" slot="2.7">2.7.18-r6</vulnerable> + <vulnerable range="lt" slot="3.6">3.6.12-r2</vulnerable> + <vulnerable range="lt" slot="3.7">3.7.9-r2</vulnerable> + <vulnerable range="lt" slot="3.8">3.8.7-r1</vulnerable> + <vulnerable range="lt" slot="3.9">3.9.1-r1</vulnerable> + </package> + </affected> + <background> + <p>Python is an interpreted, interactive, object-oriented programming + language. + </p> + </background> + <description> + <p>Multiple vulnerabilities have been discovered in Python. Please review + the bugs referenced below for details. + </p> + </description> + <impact type="normal"> + <p>A remote attacker could possibly execute arbitrary code with the + privileges of the process, or cause a Denial of Service condition. + </p> + </impact> + <workaround> + <p>There is no known workaround at this time.</p> + </workaround> + <resolution> + <p>All Python 2.7 users should upgrade to the latest version:</p> + + <code> + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-lang/python-2.7.18-r5" + </code> + + <p>All Python 3.6 users should upgrade to the latest version:</p> + + <code> + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-lang/python-3.6.12-r1" + </code> + + <p>All Python 3.7 users should upgrade to the latest version:</p> + + <code> + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-lang/python-3.7.9-r1" + </code> + + <p>All Python 3.8 users should upgrade to the latest version:</p> + + <code> + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-lang/python-3.8.6-r1" + </code> + + <p>All Python 3.9 users should upgrade to the latest version:</p> + + <code> + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-lang/python-3.9.0-r1" + </code> + + </resolution> + <references> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-26116">CVE-2020-26116</uri> + <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-3177">CVE-2021-3177</uri> + </references> + <metadata tag="requester" timestamp="2021-01-04T03:36:56Z">sam_c</metadata> + <metadata tag="submitter" timestamp="2021-01-24T23:58:22Z">sam_c</metadata> +</glsa> |