SB2019042504 - OpenSUSE Linux update for python

Security Bulletin ID SB2019042504

Severity

Medium

Patch available

YES

Number of vulnerabilities 2

Exploitation vector Remote access

Highest impact Denial of service

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Input validation error (CVE-ID: CVE-2019-9636)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input when processing data in Unicode encoding with an incorrect netloc during NFKC normalization. A remote attacker can gain access to sensitive information.

2) Exposed dangerous method or function (CVE-ID: CVE-2019-9948)

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to urllib implementation in Python 2.x supports the local_file: scheme. An attacker with ability to control input data, such as URL, can bypass protection mechanisms that blacklist file: URIs and view contents of arbitrary file on the system.

PoC:

urllib.urlopen('local_file:///etc/passwd')

Remediation

Install update from vendor's website.

References

https://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html