Mageia alert MGASA-2018-0495 (python)

From:
             
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
             
 
updates-announce@ml.mageia.org 
Subject:
             
 
[updates-announce] MGASA-2018-0495: Updated python packages fix security vulnerabilities 
Date:
             
 
Mon, 31 Dec 2018 23:42:58 +0100
Message-ID:
             
 
<20181231224258.E846B9FDB6@duvel.mageia.org>
MGASA-2018-0495 - Updated python packages fix security vulnerabilities

Publication date: 31 Dec 2018
URL: https://advisories.mageia.org/MGASA-2018-0495.html
Type: security
Affected Mageia releases: 6
CVE: CVE-2017-18207,
     CVE-2018-14647,
     CVE-2018-1000802

Description:
Possible denial of service vulnerability due to a missing check in
Lib/wave.py to verify that at least one channel is provided
(CVE-2017-18207).

Python's elementtree C accelerator failed to initialise Expat's hash
salt during initialization. This could make it easy to conduct denial of
service attacks against Expat by contructing an XML document that would
cause pathological hash collisions in Expat's internal data structures,
consuming large amounts CPU and RAM (CVE-2018-14647).

It was discovered that the shutil module of python does not properly
sanitize input when creating a zip file on Windows. An attacker could
use this flaw to cause a denial of service or add unintended files to
the generated archive (CVE-2018-1000802).

References:
- https://bugs.mageia.org/show_bug.cgi?id=23061
- https://lists.opensuse.org/opensuse-updates/2018-04/msg00...
-
https://lists.fedoraproject.org/archives/list/package-ann...
-
https://lists.fedoraproject.org/archives/list/package-ann...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1...

SRPMS:
- 6/core/python-2.7.15-1.1.mga6