RHSA-2020:4285MediumCVSS 8.0

Red Hat Security Advisory: rh-python36 security, bug fix, and enhancement update

Published
October 19, 2020
Last Modified
October 7, 2026

🔗 CVE IDs covered (7)

CVE-2020-26116 →CVE-2019-16935 →CVE-2019-18348 →CVE-2019-20907 →CVE-2019-20916 →CVE-2020-8492 →CVE-2020-14422 →

📋 Description

CVE-2019-16935 — python: XSS vulnerability in the documentation XML-RPC server in server_title field CVE-2019-18348 — python: CRLF injection via the host part of the url passed to urlopen() CVE-2019-20907 — python: infinite loop in the tarfile module via crafted TAR archive CVE-2019-20916 — python-pip: directory traversal in _download_http_url() function in src/pip/_internal/download.py CVE-2020-8492 — python: wrong backtracking in urllib.request.AbstractBasicAuthHandler allows for a ReDoS CVE-2020-14422 — python: DoS via inefficiency in IPv{4,6}Interface classes CVE-2020-26116 — python: CRLF injection via HTTP request method in httplib/http.client

🎯 Affected products140

  • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)
  • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)
  • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
  • rh-python36-python-0:3.6.12-1.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)
  • rh-python36-python-0:3.6.12-1.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)
  • rh-python36-python-0:3.6.12-1.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)
  • rh-python36-python-0:3.6.12-1.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)
  • rh-python36-python-0:3.6.12-1.el7.aarch64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-python36-python-0:3.6.12-1.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-python36-python-0:3.6.12-1.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • rh-python36-python-0:3.6.12-1.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-python36-python-0:3.6.12-1.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-python36-python-0:3.6.12-1.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • rh-python36-python-0:3.6.12-1.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-python36-python-0:3.6.12-1.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-python36-python-0:3.6.12-1.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • rh-python36-python-0:3.6.12-1.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-python36-python-0:3.6.12-1.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
  • rh-python36-python-0:3.6.12-1.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-python36-python-0:3.6.12-1.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • rh-python36-python-0:3.6.12-1.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-python36-python-0:3.6.12-1.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
  • rh-python36-python-debug-0:3.6.12-1.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)
  • rh-python36-python-debug-0:3.6.12-1.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)
  • rh-python36-python-debug-0:3.6.12-1.el7.aarch64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-python36-python-debug-0:3.6.12-1.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-python36-python-debug-0:3.6.12-1.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • +110 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: This flaw can be mitigated by not opening untrusted files with tarfile. Workaround: Avoid downloading or installing packages from potentially malicious servers via the command-line "pip download" or "pip install". Workaround: As a short term solution, if your application is using the IPv4Interface/IPv6Interface classes as keys of a dictionary, it is possible to patch the __hash__ method of those classes to not be constant. ``` IPv4Interface.__hash__ = lambda self: hash((self._ip, self._prefixlen, int(self.network.network_address))) IPv6Interface.__hash__ = lambda self: hash((self._ip, self._prefixlen, int(self.network.network_address))) ```

🔗 References (12)