Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Oracle Python packages risk code execution and service slowdown
published 5 years ago
Summary
The Oracle-provided Python packages (python, python-devel, python-libs, python-test, python-tools) contain several bugs that could let an attacker run unwanted code or make the server unresponsive. These flaws involve unsafe handling of web data and patterns that can be abused during normal use. Upgrade to the latest patched versions or apply the vendor’s recommended updates as soon as possible.
What to do
- Update oracle python to version 2.6.6-70.el6.cloudlinux.els.
- Update oracle python-devel to version 2.6.6-70.el6.cloudlinux.els.
- Update oracle python-libs to version 2.6.6-70.el6.cloudlinux.els.
- Update oracle python-test to version 2.6.6-70.el6.cloudlinux.els.
- Update oracle python-tools to version 2.6.6-70.el6.cloudlinux.els.
- Update oracle tkinter to version 2.6.6-70.el6.cloudlinux.els.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:OracleLinux:6 | oracle | python |
< 2.6.6-70.el6.cloudlinux.els Fix: upgrade to 2.6.6-70.el6.cloudlinux.els
|
| TuxCare:OracleLinux:6 | oracle | python-devel |
< 2.6.6-70.el6.cloudlinux.els Fix: upgrade to 2.6.6-70.el6.cloudlinux.els
|
| TuxCare:OracleLinux:6 | oracle | python-libs |
< 2.6.6-70.el6.cloudlinux.els Fix: upgrade to 2.6.6-70.el6.cloudlinux.els
|
| TuxCare:OracleLinux:6 | oracle | python-test |
< 2.6.6-70.el6.cloudlinux.els Fix: upgrade to 2.6.6-70.el6.cloudlinux.els
|
| TuxCare:OracleLinux:6 | oracle | python-tools |
< 2.6.6-70.el6.cloudlinux.els Fix: upgrade to 2.6.6-70.el6.cloudlinux.els
|
| TuxCare:OracleLinux:6 | oracle | tkinter |
< 2.6.6-70.el6.cloudlinux.els Fix: upgrade to 2.6.6-70.el6.cloudlinux.els
|
Original advisory text
Fixed CVEs in python: CVE-2018-20852, CVE-2020-8492, CVE-2020-26116, CVE-2020-27619
- Add Oracle Linux distribution in platform.py
- CVE-2018-20852: Prefix dot in domain for proper subdomain validation
- CVE-2020-8492: Python allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client
- CVE-2020-26116: http.client allows CRLF injection if the attacker controls the HTTP request method
- CVE-2020-27619: Unsafe use of eval() on data retrieved via HTTP in the test suite
- CVE-2018-20852: Prefix dot in domain for proper subdomain validation
- CVE-2020-8492: Python allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client
- CVE-2020-26116: http.client allows CRLF injection if the attacker controls the HTTP request method
- CVE-2020-27619: Unsafe use of eval() on data retrieved via HTTP in the test suite
References
- https://errata.cloudlinux.com/ol6/CLSA-2021-1634925483.html Vendor Advisory
Timeline
Published22 Oct 2021
Updated21 Oct 2026
First seen21 Oct 2026
Sources
CLSA-2021-1634925483 · OSV
Track software like this
Free during beta