SUSE-SU-2020:3865-1: important: Security update for python36

[sle-updates at lists.suse.com]

   SUSE Security Update: Security update for python36
______________________________________________________________________________

Announcement ID:    SUSE-SU-2020:3865-1
Rating:             important
References:         #1155094 #1162367 #1174571 #1176262 #1178009 
                    #1179630 
Cross-References:   CVE-2019-18348 CVE-2019-20916 CVE-2020-27619
                    CVE-2020-8492
Affected Products:
                    SUSE Linux Enterprise Server 12-SP5
______________________________________________________________________________

   An update that solves four vulnerabilities and has two
   fixes is now available.

Description:

   This update for python36 fixes the following issues:

   - CVE-2019-18348: Fixed a CRLF injection via the host part of the url
     passed to urlopen() (bsc#1155094)
   - CVE-2019-20916: Fixed a directory traversal in _download_http_url()
     (bsc#1176262).
   - CVE-2020-27619: Fixed an issue where the CJK codec tests call eval() on
     content retrieved via HTTP (bsc#1178009).
   - CVE-2020-8492: Fixed a regular expression in urrlib that was prone to
     denial of service via HTTP (bsc#1162367).
   - Working-around missing python-packaging dependency in python-Sphinx is
     not necessary anymore (bsc#1174571).
   - Build of python3 documentation is not independent on the version of
     Sphinx(bsc#1179630).


Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Server 12-SP5:

      zypper in -t patch SUSE-SLE-SERVER-12-SP5-2020-3865=1



Package List:

   - SUSE Linux Enterprise Server 12-SP5 (aarch64 ppc64le s390x x86_64):

      libpython3_6m1_0-3.6.12-4.25.1
      libpython3_6m1_0-debuginfo-3.6.12-4.25.1
      python36-3.6.12-4.25.1
      python36-base-3.6.12-4.25.1
      python36-base-debuginfo-3.6.12-4.25.1
      python36-debuginfo-3.6.12-4.25.1
      python36-debugsource-3.6.12-4.25.1


References:

   https://www.suse.com/security/cve/CVE-2019-18348.html
   https://www.suse.com/security/cve/CVE-2019-20916.html
   https://www.suse.com/security/cve/CVE-2020-27619.html
   https://www.suse.com/security/cve/CVE-2020-8492.html
   https://bugzilla.suse.com/1155094
   https://bugzilla.suse.com/1162367
   https://bugzilla.suse.com/1174571
   https://bugzilla.suse.com/1176262
   https://bugzilla.suse.com/1178009
   https://bugzilla.suse.com/1179630