CentOS ProjectCESA-2020:5009python, tkinter security update
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
Percentile
85.1%
CentOS Errata and Security Advisory CESA-2020:5009
Python is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries.
Security Fix(es):
- python: infinite loop in the tarfile module via crafted TAR archive (CVE-2019-20907)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2020-November/085946.html
Affected packages:
python
python-debug
python-devel
python-libs
python-test
python-tools
tkinter
Upstream details at:
https://access.redhat.com/errata/RHSA-2020:5009
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| CentOS | 7 | x86_64 | python | < 2.7.5-90.el7 | python-2.7.5-90.el7.x86_64.rpm |
| CentOS | 7 | x86_64 | python-debug | < 2.7.5-90.el7 | python-debug-2.7.5-90.el7.x86_64.rpm |
| CentOS | 7 | x86_64 | python-devel | < 2.7.5-90.el7 | python-devel-2.7.5-90.el7.x86_64.rpm |
| CentOS | 7 | i686 | python-libs | < 2.7.5-90.el7 | python-libs-2.7.5-90.el7.i686.rpm |
| CentOS | 7 | x86_64 | python-libs | < 2.7.5-90.el7 | python-libs-2.7.5-90.el7.x86_64.rpm |
| CentOS | 7 | x86_64 | python-test | < 2.7.5-90.el7 | python-test-2.7.5-90.el7.x86_64.rpm |
| CentOS | 7 | x86_64 | python-tools | < 2.7.5-90.el7 | python-tools-2.7.5-90.el7.x86_64.rpm |
| CentOS | 7 | x86_64 | tkinter | < 2.7.5-90.el7 | tkinter-2.7.5-90.el7.x86_64.rpm |
Related
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
Percentile
85.1%