Security update for python36
This update for python36 fixes the following issues: - CVE-2019-18348: Fixed a CRLF injection via the host part of the url passed to urlopen() (bsc#1155094) - CVE-2019-20916: Fixed a directory traversal in _download_http_url() (bsc#1176262). - CVE-2020-27619: Fixed an issue where the CJK codec tests call eval() on content retrieved via HTTP (bsc#1178009). - CVE-2020-8492: Fixed a regular expression in urrlib that was prone to denial of service via HTTP (bsc#1162367). - Working-around missing python-packaging dependency in python-Sphinx is not necessary anymore (bsc#1174571). - Build of python3 documentation is not independent on the version of Sphinx(bsc#1179630).
02 / AFFECTED SOFTWARE
Affected packages
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
This update for python36 fixes the following issues: - CVE-2019-18348: Fixed a CRLF injection via the host part of the url passed to urlopen() (bsc#1155094) - CVE-2019-20916: Fixed a directory traversal in _download_http_url() (bsc#1176262). - CVE-2020-27619: Fixed an issue where the CJK codec tests call eval() on content retrieved via HTTP (bsc#1178009). - CVE-2020-8492: Fixed a regular expression in urrlib that was prone to denial of service via HTTP (bsc#1162367). - Working-around missing python-packaging dependency in python-Sphinx is not necessary anymore (bsc#1174571). - Build of python3 documentation is not independent on the version of Sphinx(bsc#1179630).
05 / REFERENCES
Further evidence
- https://bugzilla.suse.com/1155094
- https://bugzilla.suse.com/1162367
- https://bugzilla.suse.com/1174571
- https://bugzilla.suse.com/1176262
- https://bugzilla.suse.com/1178009
- https://bugzilla.suse.com/1179630
- https://www.suse.com/security/cve/CVE-2019-18348
- https://www.suse.com/security/cve/CVE-2019-20916
- https://www.suse.com/security/cve/CVE-2020-27619
- https://www.suse.com/security/cve/CVE-2020-8492
- https://www.suse.com/support/update/announcement/2020/suse-su-20203865-1/