SUSE update for aws-cli, python-boto3, python-botocore, python-service_identity, python-trustme, python-urllib3

1) CRLF injection

EUVDB-ID: #VU47403

Risk: Medium

CVSSv4.0: 0.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-26137

CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to inject arbitrary data in server response.

The vulnerability exists due to insufficient validation of attacker-supplied data passed via the "method" parameter. A remote authenticated attacker can pass specially crafted data to the application containing CR-LF characters and modify application behavior.

Mitigation

Update the affected package aws-cli, python-boto3, python-botocore, python-service_identity, python-trustme, python-urllib3 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Module for Public Cloud: 15-SP1 - 15-SP3

SUSE Linux Enterprise Module for Python2: 15-SP2 - 15-SP3

SUSE Manager Proxy: 4.0

SUSE Manager Retail Branch Server: 4.0

SUSE Manager Server: 4.0

SUSE Linux Enterprise Server for SAP: 15-SP1

SUSE Linux Enterprise High Performance Computing: 15-SP1-LTSS - 15-SP1-ESPOS

SUSE Enterprise Storage: 6

SUSE CaaS Platform: 4.0

SUSE MicroOS: 5.0

SUSE Linux Enterprise Module for Packagehub Subpackages: 15-SP2 - 15-SP3

SUSE Linux Enterprise Server: 15-SP1-BCL - 15-SP1-LTSS

SUSE Linux Enterprise Module for Basesystem: 15-SP2 - 15-SP3

python3-cryptography-debuginfo: before 2.8-10.1

python3-cffi-debuginfo: before 1.13.2-3.2.5

python2-botocore: before 1.20.9-33.1

python2-boto3: before 1.17.9-19.1

python3-trustme: before 0.6.0-3.3.1

python3-service_identity: before 18.1.0-3.3.1

aws-cli: before 1.19.9-26.1

python2-pyOpenSSL: before 17.5.0-8.3.1

python2-cryptography-debuginfo: before 2.8-10.1

python2-cryptography: before 2.8-10.1

python2-cffi-debuginfo: before 1.13.2-3.2.5

python2-cffi: before 1.13.2-3.2.5

python-cryptography-debugsource: before 2.8-10.1

python-cryptography-debuginfo: before 2.8-10.1

python-cffi-debugsource: before 1.13.2-3.2.5

python-cffi-debuginfo: before 1.13.2-3.2.5

python3-botocore: before 1.20.9-33.1

python3-boto3: before 1.17.9-19.1

python2-urllib3: before 1.25.10-9.14.1

python2-pycparser: before 2.17-3.2.1

python2-pyasn1: before 0.4.2-3.2.1

python2-asn1crypto: before 0.24.0-3.2.1

python3-urllib3: before 1.25.10-9.14.1

python3-pycparser: before 2.17-3.2.1

python3-pyasn1: before 0.4.2-3.2.1

python3-pyOpenSSL: before 17.5.0-8.3.1

python3-asn1crypto: before 0.24.0-3.2.1

python3-cryptography: before 2.8-10.1

python3-cffi: before 1.13.2-3.2.5

CPE2.3

• cpe:2.3:o:suse:suse_linux_enterprise_module_for_public_cloud:15-SP1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_public_cloud:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_public_cloud:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_python2:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_python2:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.0:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.0:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.0:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP1-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_enterprise_storage:6:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_caas_platform:4.0:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_microos:5.0:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_packagehub_subpackages:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-BCL:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_basesystem:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:python3-cryptography-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:python3-cffi-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:python2-botocore:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:python2-boto3:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:python3-trustme:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:python3-service_identity:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:aws-cli:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:python2-pyopenssl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:python2-cryptography-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:python2-cryptography:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:python2-cffi-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:python2-cffi:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:python-cryptography-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:python-cryptography-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:python-cffi-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:python-cffi-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:python3-botocore:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:python3-boto3:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:python2-urllib3:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:python2-pycparser:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:python2-pyasn1:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:python2-asn1crypto:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:python3-urllib3:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:python3-pycparser:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:python3-pyasn1:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:python3-pyopenssl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:python3-asn1crypto:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:python3-cryptography:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:python3-cffi:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2021/suse-su-20212817-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.