Security update for python36 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2024:3293-1 Final 1 1 2024-09-18T06:39:04Z current 2024-09-18T06:39:04Z 2024-09-18T06:39:04Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for python36 This update for python36 fixes the following issues: - CVE-2024-7592: quadratic complexity when parsing cookies with backslashes. (bsc#1229596) - CVE-2024-6923: email header injection due to unquoted newlines. (bsc#1228780) Bug fixes: - Set variable %{profileopt} according to the variable %{do_profiling}. (bsc#1227999) - Stop using %%defattr, as it seems to be breaking proper executable attributes on /usr/bin/ scripts. (bsc#1227378) - Remove %suse_update_desktop_file macro, as it is not useful any more. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES12-SP5-Azure-BYOS-2024-3293,Image SLES12-SP5-Azure-HPC-BYOS-2024-3293,Image SLES12-SP5-Azure-HPC-On-Demand-2024-3293,Image SLES12-SP5-Azure-SAP-BYOS-2024-3293,Image SLES12-SP5-Azure-SAP-On-Demand-2024-3293,Image SLES12-SP5-Azure-Standard-On-Demand-2024-3293,Image SLES12-SP5-EC2-BYOS-2024-3293,Image SLES12-SP5-EC2-ECS-On-Demand-2024-3293,Image SLES12-SP5-EC2-On-Demand-2024-3293,Image SLES12-SP5-EC2-SAP-BYOS-2024-3293,Image SLES12-SP5-EC2-SAP-On-Demand-2024-3293,Image SLES12-SP5-GCE-BYOS-2024-3293,Image SLES12-SP5-GCE-On-Demand-2024-3293,Image SLES12-SP5-GCE-SAP-BYOS-2024-3293,Image SLES12-SP5-GCE-SAP-On-Demand-2024-3293,Image SLES12-SP5-SAP-Azure-LI-BYOS-Production-2024-3293,Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production-2024-3293,SUSE-2024-3293,SUSE-SLE-SDK-12-SP5-2024-3293,SUSE-SLE-SERVER-12-SP5-2024-3293 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2024/suse-su-20243293-1/ Link for SUSE-SU-2024:3293-1 https://lists.suse.com/pipermail/sle-updates/2024-September/036935.html E-Mail link for SUSE-SU-2024:3293-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1227378 SUSE Bug 1227378 https://bugzilla.suse.com/1227999 SUSE Bug 1227999 https://bugzilla.suse.com/1228780 SUSE Bug 1228780 https://bugzilla.suse.com/1229596 SUSE Bug 1229596 https://www.suse.com/security/cve/CVE-2024-6923/ SUSE CVE CVE-2024-6923 page https://www.suse.com/security/cve/CVE-2024-7592/ SUSE CVE CVE-2024-7592 page Image SLES12-SP5-Azure-BYOS Image SLES12-SP5-Azure-HPC-BYOS Image SLES12-SP5-Azure-HPC-On-Demand Image SLES12-SP5-Azure-SAP-BYOS Image SLES12-SP5-Azure-SAP-On-Demand Image SLES12-SP5-Azure-Standard-On-Demand Image SLES12-SP5-EC2-BYOS Image SLES12-SP5-EC2-ECS-On-Demand Image SLES12-SP5-EC2-On-Demand Image SLES12-SP5-EC2-SAP-BYOS Image SLES12-SP5-EC2-SAP-On-Demand Image SLES12-SP5-GCE-BYOS Image SLES12-SP5-GCE-On-Demand Image SLES12-SP5-GCE-SAP-BYOS Image SLES12-SP5-GCE-SAP-On-Demand Image SLES12-SP5-SAP-Azure-LI-BYOS-Production Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP5 libpython3_6m1_0-3.6.15-61.1 python36-base-3.6.15-61.1 libpython3_6m1_0-32bit-3.6.15-61.1 libpython3_6m1_0-64bit-3.6.15-61.1 python36-3.6.15-61.1 python36-32bit-3.6.15-61.1 python36-64bit-3.6.15-61.1 python36-base-32bit-3.6.15-61.1 python36-base-64bit-3.6.15-61.1 python36-curses-3.6.15-61.1 python36-dbm-3.6.15-61.1 python36-devel-3.6.15-61.1 python36-idle-3.6.15-61.1 python36-testsuite-3.6.15-61.1 python36-tk-3.6.15-61.1 python36-tools-3.6.15-61.1 libpython3_6m1_0-3.6.15-61.1 as a component of Image SLES12-SP5-Azure-BYOS python36-base-3.6.15-61.1 as a component of Image SLES12-SP5-Azure-BYOS libpython3_6m1_0-3.6.15-61.1 as a component of Image SLES12-SP5-Azure-HPC-BYOS python36-base-3.6.15-61.1 as a component of Image SLES12-SP5-Azure-HPC-BYOS libpython3_6m1_0-3.6.15-61.1 as a component of Image SLES12-SP5-Azure-HPC-On-Demand python36-base-3.6.15-61.1 as a component of Image SLES12-SP5-Azure-HPC-On-Demand libpython3_6m1_0-3.6.15-61.1 as a component of Image SLES12-SP5-Azure-SAP-BYOS python36-base-3.6.15-61.1 as a component of Image SLES12-SP5-Azure-SAP-BYOS libpython3_6m1_0-3.6.15-61.1 as a component of Image SLES12-SP5-Azure-SAP-On-Demand python36-base-3.6.15-61.1 as a component of Image SLES12-SP5-Azure-SAP-On-Demand libpython3_6m1_0-3.6.15-61.1 as a component of Image SLES12-SP5-Azure-Standard-On-Demand python36-base-3.6.15-61.1 as a component of Image SLES12-SP5-Azure-Standard-On-Demand libpython3_6m1_0-3.6.15-61.1 as a component of Image SLES12-SP5-EC2-BYOS python36-base-3.6.15-61.1 as a component of Image SLES12-SP5-EC2-BYOS libpython3_6m1_0-3.6.15-61.1 as a component of Image SLES12-SP5-EC2-ECS-On-Demand python36-base-3.6.15-61.1 as a component of Image SLES12-SP5-EC2-ECS-On-Demand libpython3_6m1_0-3.6.15-61.1 as a component of Image SLES12-SP5-EC2-On-Demand python36-base-3.6.15-61.1 as a component of Image SLES12-SP5-EC2-On-Demand libpython3_6m1_0-3.6.15-61.1 as a component of Image SLES12-SP5-EC2-SAP-BYOS python36-base-3.6.15-61.1 as a component of Image SLES12-SP5-EC2-SAP-BYOS libpython3_6m1_0-3.6.15-61.1 as a component of Image SLES12-SP5-EC2-SAP-On-Demand python36-base-3.6.15-61.1 as a component of Image SLES12-SP5-EC2-SAP-On-Demand libpython3_6m1_0-3.6.15-61.1 as a component of Image SLES12-SP5-GCE-BYOS python36-base-3.6.15-61.1 as a component of Image SLES12-SP5-GCE-BYOS libpython3_6m1_0-3.6.15-61.1 as a component of Image SLES12-SP5-GCE-On-Demand python36-base-3.6.15-61.1 as a component of Image SLES12-SP5-GCE-On-Demand libpython3_6m1_0-3.6.15-61.1 as a component of Image SLES12-SP5-GCE-SAP-BYOS python36-base-3.6.15-61.1 as a component of Image SLES12-SP5-GCE-SAP-BYOS libpython3_6m1_0-3.6.15-61.1 as a component of Image SLES12-SP5-GCE-SAP-On-Demand python36-base-3.6.15-61.1 as a component of Image SLES12-SP5-GCE-SAP-On-Demand libpython3_6m1_0-3.6.15-61.1 as a component of Image SLES12-SP5-SAP-Azure-LI-BYOS-Production python36-base-3.6.15-61.1 as a component of Image SLES12-SP5-SAP-Azure-LI-BYOS-Production libpython3_6m1_0-3.6.15-61.1 as a component of Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production python36-base-3.6.15-61.1 as a component of Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production libpython3_6m1_0-3.6.15-61.1 as a component of SUSE Linux Enterprise Server 12 SP5 libpython3_6m1_0-32bit-3.6.15-61.1 as a component of SUSE Linux Enterprise Server 12 SP5 python36-3.6.15-61.1 as a component of SUSE Linux Enterprise Server 12 SP5 python36-base-3.6.15-61.1 as a component of SUSE Linux Enterprise Server 12 SP5 libpython3_6m1_0-3.6.15-61.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libpython3_6m1_0-32bit-3.6.15-61.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 python36-3.6.15-61.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 python36-base-3.6.15-61.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 python36-devel-3.6.15-61.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 There is a MEDIUM severity vulnerability affecting CPython. The email module didn't properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized. CVE-2024-6923 Image SLES12-SP5-Azure-BYOS:libpython3_6m1_0-3.6.15-61.1 Image SLES12-SP5-Azure-BYOS:python36-base-3.6.15-61.1 Image SLES12-SP5-Azure-HPC-BYOS:libpython3_6m1_0-3.6.15-61.1 Image SLES12-SP5-Azure-HPC-BYOS:python36-base-3.6.15-61.1 Image SLES12-SP5-Azure-HPC-On-Demand:libpython3_6m1_0-3.6.15-61.1 Image SLES12-SP5-Azure-HPC-On-Demand:python36-base-3.6.15-61.1 Image SLES12-SP5-Azure-SAP-BYOS:libpython3_6m1_0-3.6.15-61.1 Image SLES12-SP5-Azure-SAP-BYOS:python36-base-3.6.15-61.1 Image SLES12-SP5-Azure-SAP-On-Demand:libpython3_6m1_0-3.6.15-61.1 Image SLES12-SP5-Azure-SAP-On-Demand:python36-base-3.6.15-61.1 Image SLES12-SP5-Azure-Standard-On-Demand:libpython3_6m1_0-3.6.15-61.1 Image SLES12-SP5-Azure-Standard-On-Demand:python36-base-3.6.15-61.1 Image SLES12-SP5-EC2-BYOS:libpython3_6m1_0-3.6.15-61.1 Image SLES12-SP5-EC2-BYOS:python36-base-3.6.15-61.1 Image SLES12-SP5-EC2-ECS-On-Demand:libpython3_6m1_0-3.6.15-61.1 Image SLES12-SP5-EC2-ECS-On-Demand:python36-base-3.6.15-61.1 Image SLES12-SP5-EC2-On-Demand:libpython3_6m1_0-3.6.15-61.1 Image SLES12-SP5-EC2-On-Demand:python36-base-3.6.15-61.1 Image SLES12-SP5-EC2-SAP-BYOS:libpython3_6m1_0-3.6.15-61.1 Image SLES12-SP5-EC2-SAP-BYOS:python36-base-3.6.15-61.1 Image SLES12-SP5-EC2-SAP-On-Demand:libpython3_6m1_0-3.6.15-61.1 Image SLES12-SP5-EC2-SAP-On-Demand:python36-base-3.6.15-61.1 Image SLES12-SP5-GCE-BYOS:libpython3_6m1_0-3.6.15-61.1 Image SLES12-SP5-GCE-BYOS:python36-base-3.6.15-61.1 Image SLES12-SP5-GCE-On-Demand:libpython3_6m1_0-3.6.15-61.1 Image SLES12-SP5-GCE-On-Demand:python36-base-3.6.15-61.1 Image SLES12-SP5-GCE-SAP-BYOS:libpython3_6m1_0-3.6.15-61.1 Image SLES12-SP5-GCE-SAP-BYOS:python36-base-3.6.15-61.1 Image SLES12-SP5-GCE-SAP-On-Demand:libpython3_6m1_0-3.6.15-61.1 Image SLES12-SP5-GCE-SAP-On-Demand:python36-base-3.6.15-61.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:libpython3_6m1_0-3.6.15-61.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:python36-base-3.6.15-61.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:libpython3_6m1_0-3.6.15-61.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:python36-base-3.6.15-61.1 SUSE Linux Enterprise Server 12 SP5:libpython3_6m1_0-3.6.15-61.1 SUSE Linux Enterprise Server 12 SP5:libpython3_6m1_0-32bit-3.6.15-61.1 SUSE Linux Enterprise Server 12 SP5:python36-3.6.15-61.1 SUSE Linux Enterprise Server 12 SP5:python36-base-3.6.15-61.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpython3_6m1_0-3.6.15-61.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpython3_6m1_0-32bit-3.6.15-61.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python36-3.6.15-61.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python36-base-3.6.15-61.1 SUSE Linux Enterprise Software Development Kit 12 SP5:python36-devel-3.6.15-61.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20243293-1/ https://www.suse.com/security/cve/CVE-2024-6923.html CVE-2024-6923 https://bugzilla.suse.com/1228780 SUSE Bug 1228780 There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used while parsing the value. CVE-2024-7592 Image SLES12-SP5-Azure-BYOS:libpython3_6m1_0-3.6.15-61.1 Image SLES12-SP5-Azure-BYOS:python36-base-3.6.15-61.1 Image SLES12-SP5-Azure-HPC-BYOS:libpython3_6m1_0-3.6.15-61.1 Image SLES12-SP5-Azure-HPC-BYOS:python36-base-3.6.15-61.1 Image SLES12-SP5-Azure-HPC-On-Demand:libpython3_6m1_0-3.6.15-61.1 Image SLES12-SP5-Azure-HPC-On-Demand:python36-base-3.6.15-61.1 Image SLES12-SP5-Azure-SAP-BYOS:libpython3_6m1_0-3.6.15-61.1 Image SLES12-SP5-Azure-SAP-BYOS:python36-base-3.6.15-61.1 Image SLES12-SP5-Azure-SAP-On-Demand:libpython3_6m1_0-3.6.15-61.1 Image SLES12-SP5-Azure-SAP-On-Demand:python36-base-3.6.15-61.1 Image SLES12-SP5-Azure-Standard-On-Demand:libpython3_6m1_0-3.6.15-61.1 Image SLES12-SP5-Azure-Standard-On-Demand:python36-base-3.6.15-61.1 Image SLES12-SP5-EC2-BYOS:libpython3_6m1_0-3.6.15-61.1 Image SLES12-SP5-EC2-BYOS:python36-base-3.6.15-61.1 Image SLES12-SP5-EC2-ECS-On-Demand:libpython3_6m1_0-3.6.15-61.1 Image SLES12-SP5-EC2-ECS-On-Demand:python36-base-3.6.15-61.1 Image SLES12-SP5-EC2-On-Demand:libpython3_6m1_0-3.6.15-61.1 Image SLES12-SP5-EC2-On-Demand:python36-base-3.6.15-61.1 Image SLES12-SP5-EC2-SAP-BYOS:libpython3_6m1_0-3.6.15-61.1 Image SLES12-SP5-EC2-SAP-BYOS:python36-base-3.6.15-61.1 Image SLES12-SP5-EC2-SAP-On-Demand:libpython3_6m1_0-3.6.15-61.1 Image SLES12-SP5-EC2-SAP-On-Demand:python36-base-3.6.15-61.1 Image SLES12-SP5-GCE-BYOS:libpython3_6m1_0-3.6.15-61.1 Image SLES12-SP5-GCE-BYOS:python36-base-3.6.15-61.1 Image SLES12-SP5-GCE-On-Demand:libpython3_6m1_0-3.6.15-61.1 Image SLES12-SP5-GCE-On-Demand:python36-base-3.6.15-61.1 Image SLES12-SP5-GCE-SAP-BYOS:libpython3_6m1_0-3.6.15-61.1 Image SLES12-SP5-GCE-SAP-BYOS:python36-base-3.6.15-61.1 Image SLES12-SP5-GCE-SAP-On-Demand:libpython3_6m1_0-3.6.15-61.1 Image SLES12-SP5-GCE-SAP-On-Demand:python36-base-3.6.15-61.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:libpython3_6m1_0-3.6.15-61.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:python36-base-3.6.15-61.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:libpython3_6m1_0-3.6.15-61.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:python36-base-3.6.15-61.1 SUSE Linux Enterprise Server 12 SP5:libpython3_6m1_0-3.6.15-61.1 SUSE Linux Enterprise Server 12 SP5:libpython3_6m1_0-32bit-3.6.15-61.1 SUSE Linux Enterprise Server 12 SP5:python36-3.6.15-61.1 SUSE Linux Enterprise Server 12 SP5:python36-base-3.6.15-61.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpython3_6m1_0-3.6.15-61.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpython3_6m1_0-32bit-3.6.15-61.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python36-3.6.15-61.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python36-base-3.6.15-61.1 SUSE Linux Enterprise Software Development Kit 12 SP5:python36-devel-3.6.15-61.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20243293-1/ https://www.suse.com/security/cve/CVE-2024-7592.html CVE-2024-7592 https://bugzilla.suse.com/1229596 SUSE Bug 1229596