Oracle Linux: CVE-2020-14422: ELSA-2020-4433: python3 security and bug fix update (MODERATE) (Multiple Advisories)
Description
Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this attacker can cause many dictionary entries to be created. This is fixed in: v3.5.10, v3.5.10rc1; v3.6.12; v3.7.9; v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1; v3.9.0, v3.9.0b4, v3.9.0b5, v3.9.0rc1, v3.9.0rc2. A vulnerability was found in the way the ipaddress python module computes hash values in the IPv4Interface and IPv6Interface classes. This flaw allows an attacker to create many dictionary entries, due to the performance of a dictionary containing the IPv4Interface or IPv6Interface objects, possibly resulting in a denial of service. The highest threat from this vulnerability is to system availability.
Solution(s)
- oracle-linux-upgrade-platform-python
- oracle-linux-upgrade-platform-python-debug
- oracle-linux-upgrade-platform-python-devel
- oracle-linux-upgrade-python3
- oracle-linux-upgrade-python38
- oracle-linux-upgrade-python38-asn1crypto
- oracle-linux-upgrade-python38-babel
- oracle-linux-upgrade-python38-cffi
- oracle-linux-upgrade-python38-chardet
- oracle-linux-upgrade-python38-cryptography
- oracle-linux-upgrade-python38-cython
- oracle-linux-upgrade-python38-debug
- oracle-linux-upgrade-python38-devel
- oracle-linux-upgrade-python38-idle
- oracle-linux-upgrade-python38-idna
- oracle-linux-upgrade-python38-jinja2
- oracle-linux-upgrade-python38-libs
- oracle-linux-upgrade-python38-lxml
- oracle-linux-upgrade-python38-markupsafe
- oracle-linux-upgrade-python38-mod-wsgi
- oracle-linux-upgrade-python38-numpy
- oracle-linux-upgrade-python38-numpy-doc
- oracle-linux-upgrade-python38-numpy-f2py
- oracle-linux-upgrade-python38-pip
- oracle-linux-upgrade-python38-pip-wheel
- oracle-linux-upgrade-python38-ply
- oracle-linux-upgrade-python38-psutil
- oracle-linux-upgrade-python38-psycopg2
- oracle-linux-upgrade-python38-psycopg2-doc
- oracle-linux-upgrade-python38-psycopg2-tests
- oracle-linux-upgrade-python38-pycparser
- oracle-linux-upgrade-python38-pymysql
- oracle-linux-upgrade-python38-pysocks
- oracle-linux-upgrade-python38-pytz
- oracle-linux-upgrade-python38-pyyaml
- oracle-linux-upgrade-python38-requests
- oracle-linux-upgrade-python38-rpm-macros
- oracle-linux-upgrade-python38-scipy
- oracle-linux-upgrade-python38-setuptools
- oracle-linux-upgrade-python38-setuptools-wheel
- oracle-linux-upgrade-python38-six
- oracle-linux-upgrade-python38-test
- oracle-linux-upgrade-python38-tkinter
- oracle-linux-upgrade-python38-urllib3
- oracle-linux-upgrade-python38-wheel
- oracle-linux-upgrade-python38-wheel-wheel
- oracle-linux-upgrade-python3-debug
- oracle-linux-upgrade-python3-devel
- oracle-linux-upgrade-python3-idle
- oracle-linux-upgrade-python3-libs
- oracle-linux-upgrade-python3-test
- oracle-linux-upgrade-python3-tkinter
- Lightweight Endpoint Agent
- Live Dashboards
- Real Risk Prioritization
- IT-Integrated Remediation Projects
- Cloud, Virtual, and Container Assessment
- Integrated Threat Feeds
- Easy-to-Use RESTful API
- Automation-Assisted Patching
- Automated Containment
With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.
– Scott Cheney, Manager of Information Security, Sierra View Medical Center