diff options
| author | Wen Heping <wen@FreeBSD.org> | 2020-07-06 02:02:20 +0000 |
|---|---|---|
| committer | Wen Heping <wen@FreeBSD.org> | 2020-07-06 02:02:20 +0000 |
| commit | 1b52576459da67c6b2ea59ef6f074cea055f78a8 (patch) | |
| tree | 91bea0410149d203587405246d9b394c363ef53b | |
| parent | - Update to 1.0.0 (diff) | |
- Document python37 multiple vulnerabilities
| -rw-r--r-- | security/vuxml/vuln.xml | 34 |
1 files changed, 34 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index f5496f556548..e90a0157ef06 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -58,6 +58,40 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="33c05d57-bf6e-11ea-ba1e-0800273f78d3"> + <topic>Python -- multiple vulnerabilities</topic> + <affects> + <package> + <name>ipython37</name> + <range><lt>3.7.8</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>Pytrhon reports:</p> + <blockquote cite="https://docs.python.org/3.7/whatsnew/changelog.html#changelog"> + <p>The AbstractBasicAuthHandler class of the urllib.request module uses an inefficient + regular expression which can be exploited by an attacker to cause a denial of service. + Fix the regex to prevent the catastrophic backtracking. Vulnerability reported by Ben + Caller and Matt Schwager.</p> + <p>Disallow control characters in hostnames in http.client, addressing CVE-2019-18348. + Such potentially malicious header injection URLs now cause a InvalidURL to be raised.</p> + <p>Disallow CR or LF in email.headerregistry.Address arguments to guard against header + injection attacks.</p> + </blockquote> + </body> + </description> + <references> + <url>https://docs.python.org/3.7/whatsnew/changelog.html#changelog</url> + <cvename>CVE-2019-18348</cvename> + <cvename>CVE-2020-8492</cvename> + </references> + <dates> + <discovery>2019-10-24</discovery> + <entry>2020-07-06</entry> + </dates> + </vuln> + <vuln vid="ae599263-bca2-11ea-b78f-b42e99a1b9c3"> <topic>samba -- Multiple Vulnerabilities</topic> <affects> |