Recent Vulnerabilities Research Posts Trends Blog About Contact

Related Vulnerabilities: CVE-2019-20907 CVE-2020-14422

Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this attacker can cause many dictionary entries to be created. A vulnerability was found in the way the ipaddress python module computes hash values in the IPv4Interface and IPv6Interface classes. This flaw allows an attacker to create many dictionary entries, due to the performance of a dictionary containing the IPv4Interface or IPv6Interface objects, possibly resulting in a denial of service. The highest threat from this vulnerability is to system availability. (CVE-2020-14422) In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation. (CVE-2019-20907)

Source

ALAS2-2020-1484

Amazon Linux 2 Security Advisory: ALAS-2020-1484
Advisory Release Date: 2020-09-01 00:40 Pacific
Advisory Updated Date: 2020-09-02 17:56 Pacific

Severity: Medium

References: CVE-2019-20907 CVE-2020-14422

Issue Overview:

Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this attacker can cause many dictionary entries to be created. A vulnerability was found in the way the ipaddress python module computes hash values in the IPv4Interface and IPv6Interface classes. This flaw allows an attacker to create many dictionary entries, due to the performance of a dictionary containing the IPv4Interface or IPv6Interface objects, possibly resulting in a denial of service. The highest threat from this vulnerability is to system availability. (CVE-2020-14422)

In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation. (CVE-2019-20907)

Affected Packages:

python3

Issue Correction:
Run yum update python3 to update your system.

New Packages:

aarch64:
    python3-3.7.9-1.amzn2.0.1.aarch64
    python3-libs-3.7.9-1.amzn2.0.1.aarch64
    python3-devel-3.7.9-1.amzn2.0.1.aarch64
    python3-tools-3.7.9-1.amzn2.0.1.aarch64
    python3-tkinter-3.7.9-1.amzn2.0.1.aarch64
    python3-test-3.7.9-1.amzn2.0.1.aarch64
    python3-debug-3.7.9-1.amzn2.0.1.aarch64
    python3-debuginfo-3.7.9-1.amzn2.0.1.aarch64

i686:
    python3-3.7.9-1.amzn2.0.1.i686
    python3-libs-3.7.9-1.amzn2.0.1.i686
    python3-devel-3.7.9-1.amzn2.0.1.i686
    python3-tools-3.7.9-1.amzn2.0.1.i686
    python3-tkinter-3.7.9-1.amzn2.0.1.i686
    python3-test-3.7.9-1.amzn2.0.1.i686
    python3-debug-3.7.9-1.amzn2.0.1.i686
    python3-debuginfo-3.7.9-1.amzn2.0.1.i686

src:
    python3-3.7.9-1.amzn2.0.1.src

x86_64:
    python3-3.7.9-1.amzn2.0.1.x86_64
    python3-libs-3.7.9-1.amzn2.0.1.x86_64
    python3-devel-3.7.9-1.amzn2.0.1.x86_64
    python3-tools-3.7.9-1.amzn2.0.1.x86_64
    python3-tkinter-3.7.9-1.amzn2.0.1.x86_64
    python3-test-3.7.9-1.amzn2.0.1.x86_64
    python3-debug-3.7.9-1.amzn2.0.1.x86_64
    python3-debuginfo-3.7.9-1.amzn2.0.1.x86_64

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

ALAS2-2020-1484

ALAS2-2020-1484

Vulmon Search

About

Products

Connect