SB2020042845 - Red Hat Enterprise Linux 8 update for python3
Published: April 28, 2020
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 secuirty vulnerabilities.
1) Information disclosure (CVE-ID: CVE-2018-20852)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to the "http.cookiejar.DefaultPolicy.domain_return_ok" in the "Lib/http/cookiejar.py" file returns incorrect results during cookie domain checks. A remote attacker can trick a victim to execute a program that uses the "http.cookiejar.DefaultPolicy" to make an HTTP connection to an attacker-controlled server with a hostname that has another valid hostname as a suffix.
Successful exploitation of this vulnerability can allow an attacker to gain unauthorized access to sensitive information on the system, such as existing cookies.
2) Input validation error (CVE-ID: CVE-2019-16056)
The vulnerability allows a remote attacker to bypass certain security restrictions.
The vulnerability exists due to insufficient validation of user-supplied input when processing multiple occurrences of the "@" character in an email address. An application that uses the email module and implements some kind of
checks on the From/To headers of a message could be tricked into
accepting an email address that should be denied.
Remediation
Install update from vendor's website.