ALT-PU-2015-1995-1
Closed vulnerabilities
Modified: 2024-11-21
CVE-2013-1753
The gzip_decode function in the xmlrpc client library in Python 3.4 and earlier allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP request.
Modified: 2024-11-21
CVE-2013-7440
The ssl.match_hostname function in CPython (aka Python) before 2.7.9 and 3.x before 3.3.3 does not properly handle wildcards in hostnames, which might allow man-in-the-middle attackers to spoof servers via a crafted certificate.
- [oss-security] 20150518 CVE request: ssl.match_hostname(): sub string wildcard should not match IDNA prefix
- [oss-security] 20150518 CVE request: ssl.match_hostname(): sub string wildcard should not match IDNA prefix
- [oss-security] 20150521 Re: CVE request: ssl.match_hostname(): sub string wildcard should not match IDNA prefix
- [oss-security] 20150521 Re: CVE request: ssl.match_hostname(): sub string wildcard should not match IDNA prefix
- 74707
- 74707
- RHSA-2016:1166
- RHSA-2016:1166
- https://bugs.python.org/issue17997
- https://bugs.python.org/issue17997
- https://bugzilla.redhat.com/show_bug.cgi?id=1224999
- https://bugzilla.redhat.com/show_bug.cgi?id=1224999
- https://hg.python.org/cpython/rev/10d0edadbcdd
- https://hg.python.org/cpython/rev/10d0edadbcdd
Modified: 2024-11-21
CVE-2014-9365
The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
- http://bugs.python.org/issue22417
- http://bugs.python.org/issue22417
- APPLE-SA-2015-08-13-2
- APPLE-SA-2015-08-13-2
- [oss-security] 20141211 CVE request: Python, standard library HTTP clients
- [oss-security] 20141211 CVE request: Python, standard library HTTP clients
- http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
- http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- 71639
- 71639
- RHSA-2016:1166
- RHSA-2016:1166
- RHSA-2017:1162
- RHSA-2017:1162
- RHSA-2017:1868
- RHSA-2017:1868
- GLSA-201503-10
- GLSA-201503-10
- https://support.apple.com/kb/HT205031
- https://support.apple.com/kb/HT205031
- https://www.python.org/dev/peps/pep-0476/
- https://www.python.org/dev/peps/pep-0476/
- https://www.python.org/downloads/release/python-279/
- https://www.python.org/downloads/release/python-279/
Modified: 2024-11-21
CVE-2016-5699
CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython (aka Python) before 2.7.10 and 3.x before 3.4.4 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in a URL.
- http://blog.blindspotsecurity.com/2016/06/advisory-http-header-injection-in.html
- http://blog.blindspotsecurity.com/2016/06/advisory-http-header-injection-in.html
- openSUSE-SU-2020:0086
- openSUSE-SU-2020:0086
- RHSA-2016:1626
- RHSA-2016:1626
- RHSA-2016:1627
- RHSA-2016:1627
- RHSA-2016:1628
- RHSA-2016:1628
- RHSA-2016:1629
- RHSA-2016:1629
- RHSA-2016:1630
- RHSA-2016:1630
- [oss-security] 20160614 CVE request: Python HTTP header injection in urrlib2/urllib/httplib/http.client
- [oss-security] 20160614 CVE request: Python HTTP header injection in urrlib2/urllib/httplib/http.client
- [oss-security] 20160615 Re: CVE request: Python HTTP header injection in urrlib2/urllib/httplib/http.client
- [oss-security] 20160615 Re: CVE request: Python HTTP header injection in urrlib2/urllib/httplib/http.client
- [oss-security] 20160616 Re: CVE request: Python HTTP header injection in urrlib2/urllib/httplib/http.client
- [oss-security] 20160616 Re: CVE request: Python HTTP header injection in urrlib2/urllib/httplib/http.client
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
- 91226
- 91226
- http://www.splunk.com/view/SP-CAAAPSV
- http://www.splunk.com/view/SP-CAAAPSV
- http://www.splunk.com/view/SP-CAAAPUE
- http://www.splunk.com/view/SP-CAAAPUE
- https://docs.python.org/3.4/whatsnew/changelog.html#python-3-4-4
- https://docs.python.org/3.4/whatsnew/changelog.html#python-3-4-4
- https://hg.python.org/cpython/raw-file/v2.7.10/Misc/NEWS
- https://hg.python.org/cpython/raw-file/v2.7.10/Misc/NEWS
- https://hg.python.org/cpython/rev/1c45047c5102
- https://hg.python.org/cpython/rev/1c45047c5102
- https://hg.python.org/cpython/rev/bf3e1c9b80e9
- https://hg.python.org/cpython/rev/bf3e1c9b80e9
- [debian-lts-announce] 20190207 [SECURITY] [DLA 1663-1] python3.4 security update
- [debian-lts-announce] 20190207 [SECURITY] [DLA 1663-1] python3.4 security update
Closed bugs
Добавить поддержку Bluetooth.
Обновить до 2.7.10