Security update for python SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2024:4151-1 Final 1 1 2024-12-03T10:39:18Z current 2024-12-03T10:39:18Z 2024-12-03T10:39:18Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for python This update for python fixes the following issues: - CVE-2024-11168: Fixed improper validation of IPv6 and IPvFuture addresses (bsc#1233307) Other fixes: - Add ipaddress module from https://github.com/phihag/ipaddress - Remove -IVendor/ from python-config (bsc#1231795) - Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES15-SP3-SAP-Azure-LI-BYOS-Production-2024-4151,Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production-2024-4151,Image SLES15-SP3-SAPCAL-Azure-2024-4151,Image SLES15-SP3-SAPCAL-EC2-HVM-2024-4151,Image SLES15-SP3-SAPCAL-GCE-2024-4151,SUSE-2024-4151,SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2024-4151,SUSE-SLE-Module-Packagehub-Subpackages-15-SP6-2024-4151,openSUSE-SLE-15.5-2024-4151,openSUSE-SLE-15.6-2024-4151 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2024/suse-su-20244151-1/ Link for SUSE-SU-2024:4151-1 https://lists.suse.com/pipermail/sle-security-updates/2024-December/019899.html E-Mail link for SUSE-SU-2024:4151-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1227378 SUSE Bug 1227378 https://bugzilla.suse.com/1231795 SUSE Bug 1231795 https://bugzilla.suse.com/1233307 SUSE Bug 1233307 https://www.suse.com/security/cve/CVE-2024-11168/ SUSE CVE CVE-2024-11168 page Image SLES15-SP3-SAP-Azure-LI-BYOS-Production Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production Image SLES15-SP3-SAPCAL-Azure Image SLES15-SP3-SAPCAL-EC2-HVM Image SLES15-SP3-SAPCAL-GCE SUSE Linux Enterprise Module for Package Hub 15 SP5 SUSE Linux Enterprise Module for Package Hub 15 SP6 openSUSE Leap 15.5 openSUSE Leap 15.6 libpython2_7-1_0-2.7.18-150000.68.1 python-base-2.7.18-150000.68.1 python-2.7.18-150000.68.1 python-xml-2.7.18-150000.68.1 libpython2_7-1_0-32bit-2.7.18-150000.68.1 libpython2_7-1_0-64bit-2.7.18-150000.68.1 python-32bit-2.7.18-150000.68.1 python-64bit-2.7.18-150000.68.1 python-base-32bit-2.7.18-150000.68.1 python-base-64bit-2.7.18-150000.68.1 python-curses-2.7.18-150000.68.1 python-demo-2.7.18-150000.68.1 python-devel-2.7.18-150000.68.1 python-doc-2.7.18-150000.68.1 python-doc-pdf-2.7.18-150000.68.1 python-gdbm-2.7.18-150000.68.1 python-idle-2.7.18-150000.68.1 python-tk-2.7.18-150000.68.1 libpython2_7-1_0-2.7.18-150000.68.1 as a component of Image SLES15-SP3-SAP-Azure-LI-BYOS-Production python-base-2.7.18-150000.68.1 as a component of Image SLES15-SP3-SAP-Azure-LI-BYOS-Production libpython2_7-1_0-2.7.18-150000.68.1 as a component of Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production python-base-2.7.18-150000.68.1 as a component of Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production libpython2_7-1_0-2.7.18-150000.68.1 as a component of Image SLES15-SP3-SAPCAL-Azure python-2.7.18-150000.68.1 as a component of Image SLES15-SP3-SAPCAL-Azure python-base-2.7.18-150000.68.1 as a component of Image SLES15-SP3-SAPCAL-Azure python-xml-2.7.18-150000.68.1 as a component of Image SLES15-SP3-SAPCAL-Azure libpython2_7-1_0-2.7.18-150000.68.1 as a component of Image SLES15-SP3-SAPCAL-EC2-HVM python-2.7.18-150000.68.1 as a component of Image SLES15-SP3-SAPCAL-EC2-HVM python-base-2.7.18-150000.68.1 as a component of Image SLES15-SP3-SAPCAL-EC2-HVM python-xml-2.7.18-150000.68.1 as a component of Image SLES15-SP3-SAPCAL-EC2-HVM libpython2_7-1_0-2.7.18-150000.68.1 as a component of Image SLES15-SP3-SAPCAL-GCE python-2.7.18-150000.68.1 as a component of Image SLES15-SP3-SAPCAL-GCE python-base-2.7.18-150000.68.1 as a component of Image SLES15-SP3-SAPCAL-GCE python-xml-2.7.18-150000.68.1 as a component of Image SLES15-SP3-SAPCAL-GCE libpython2_7-1_0-2.7.18-150000.68.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP5 python-2.7.18-150000.68.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP5 python-base-2.7.18-150000.68.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP5 python-curses-2.7.18-150000.68.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP5 python-devel-2.7.18-150000.68.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP5 python-gdbm-2.7.18-150000.68.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP5 python-xml-2.7.18-150000.68.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP5 libpython2_7-1_0-2.7.18-150000.68.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP6 python-2.7.18-150000.68.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP6 python-base-2.7.18-150000.68.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP6 python-curses-2.7.18-150000.68.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP6 python-gdbm-2.7.18-150000.68.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP6 python-xml-2.7.18-150000.68.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP6 libpython2_7-1_0-2.7.18-150000.68.1 as a component of openSUSE Leap 15.5 libpython2_7-1_0-32bit-2.7.18-150000.68.1 as a component of openSUSE Leap 15.5 python-2.7.18-150000.68.1 as a component of openSUSE Leap 15.5 python-32bit-2.7.18-150000.68.1 as a component of openSUSE Leap 15.5 python-base-2.7.18-150000.68.1 as a component of openSUSE Leap 15.5 python-base-32bit-2.7.18-150000.68.1 as a component of openSUSE Leap 15.5 python-curses-2.7.18-150000.68.1 as a component of openSUSE Leap 15.5 python-demo-2.7.18-150000.68.1 as a component of openSUSE Leap 15.5 python-devel-2.7.18-150000.68.1 as a component of openSUSE Leap 15.5 python-doc-2.7.18-150000.68.1 as a component of openSUSE Leap 15.5 python-doc-pdf-2.7.18-150000.68.1 as a component of openSUSE Leap 15.5 python-gdbm-2.7.18-150000.68.1 as a component of openSUSE Leap 15.5 python-idle-2.7.18-150000.68.1 as a component of openSUSE Leap 15.5 python-tk-2.7.18-150000.68.1 as a component of openSUSE Leap 15.5 python-xml-2.7.18-150000.68.1 as a component of openSUSE Leap 15.5 libpython2_7-1_0-2.7.18-150000.68.1 as a component of openSUSE Leap 15.6 libpython2_7-1_0-32bit-2.7.18-150000.68.1 as a component of openSUSE Leap 15.6 python-2.7.18-150000.68.1 as a component of openSUSE Leap 15.6 python-32bit-2.7.18-150000.68.1 as a component of openSUSE Leap 15.6 python-base-2.7.18-150000.68.1 as a component of openSUSE Leap 15.6 python-base-32bit-2.7.18-150000.68.1 as a component of openSUSE Leap 15.6 python-curses-2.7.18-150000.68.1 as a component of openSUSE Leap 15.6 python-demo-2.7.18-150000.68.1 as a component of openSUSE Leap 15.6 python-devel-2.7.18-150000.68.1 as a component of openSUSE Leap 15.6 python-doc-2.7.18-150000.68.1 as a component of openSUSE Leap 15.6 python-doc-pdf-2.7.18-150000.68.1 as a component of openSUSE Leap 15.6 python-gdbm-2.7.18-150000.68.1 as a component of openSUSE Leap 15.6 python-idle-2.7.18-150000.68.1 as a component of openSUSE Leap 15.6 python-tk-2.7.18-150000.68.1 as a component of openSUSE Leap 15.6 python-xml-2.7.18-150000.68.1 as a component of openSUSE Leap 15.6 The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser. CVE-2024-11168 Image SLES15-SP3-SAP-Azure-LI-BYOS-Production:libpython2_7-1_0-2.7.18-150000.68.1 Image SLES15-SP3-SAP-Azure-LI-BYOS-Production:python-base-2.7.18-150000.68.1 Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production:libpython2_7-1_0-2.7.18-150000.68.1 Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production:python-base-2.7.18-150000.68.1 Image SLES15-SP3-SAPCAL-Azure:libpython2_7-1_0-2.7.18-150000.68.1 Image SLES15-SP3-SAPCAL-Azure:python-2.7.18-150000.68.1 Image SLES15-SP3-SAPCAL-Azure:python-base-2.7.18-150000.68.1 Image SLES15-SP3-SAPCAL-Azure:python-xml-2.7.18-150000.68.1 Image SLES15-SP3-SAPCAL-EC2-HVM:libpython2_7-1_0-2.7.18-150000.68.1 Image SLES15-SP3-SAPCAL-EC2-HVM:python-2.7.18-150000.68.1 Image SLES15-SP3-SAPCAL-EC2-HVM:python-base-2.7.18-150000.68.1 Image SLES15-SP3-SAPCAL-EC2-HVM:python-xml-2.7.18-150000.68.1 Image SLES15-SP3-SAPCAL-GCE:libpython2_7-1_0-2.7.18-150000.68.1 Image SLES15-SP3-SAPCAL-GCE:python-2.7.18-150000.68.1 Image SLES15-SP3-SAPCAL-GCE:python-base-2.7.18-150000.68.1 Image SLES15-SP3-SAPCAL-GCE:python-xml-2.7.18-150000.68.1 SUSE Linux Enterprise Module for Package Hub 15 SP5:libpython2_7-1_0-2.7.18-150000.68.1 SUSE Linux Enterprise Module for Package Hub 15 SP5:python-2.7.18-150000.68.1 SUSE Linux Enterprise Module for Package Hub 15 SP5:python-base-2.7.18-150000.68.1 SUSE Linux Enterprise Module for Package Hub 15 SP5:python-curses-2.7.18-150000.68.1 SUSE Linux Enterprise Module for Package Hub 15 SP5:python-devel-2.7.18-150000.68.1 SUSE Linux Enterprise Module for Package Hub 15 SP5:python-gdbm-2.7.18-150000.68.1 SUSE Linux Enterprise Module for Package Hub 15 SP5:python-xml-2.7.18-150000.68.1 SUSE Linux Enterprise Module for Package Hub 15 SP6:libpython2_7-1_0-2.7.18-150000.68.1 SUSE Linux Enterprise Module for Package Hub 15 SP6:python-2.7.18-150000.68.1 SUSE Linux Enterprise Module for Package Hub 15 SP6:python-base-2.7.18-150000.68.1 SUSE Linux Enterprise Module for Package Hub 15 SP6:python-curses-2.7.18-150000.68.1 SUSE Linux Enterprise Module for Package Hub 15 SP6:python-gdbm-2.7.18-150000.68.1 SUSE Linux Enterprise Module for Package Hub 15 SP6:python-xml-2.7.18-150000.68.1 openSUSE Leap 15.5:libpython2_7-1_0-2.7.18-150000.68.1 openSUSE Leap 15.5:libpython2_7-1_0-32bit-2.7.18-150000.68.1 openSUSE Leap 15.5:python-2.7.18-150000.68.1 openSUSE Leap 15.5:python-32bit-2.7.18-150000.68.1 openSUSE Leap 15.5:python-base-2.7.18-150000.68.1 openSUSE Leap 15.5:python-base-32bit-2.7.18-150000.68.1 openSUSE Leap 15.5:python-curses-2.7.18-150000.68.1 openSUSE Leap 15.5:python-demo-2.7.18-150000.68.1 openSUSE Leap 15.5:python-devel-2.7.18-150000.68.1 openSUSE Leap 15.5:python-doc-2.7.18-150000.68.1 openSUSE Leap 15.5:python-doc-pdf-2.7.18-150000.68.1 openSUSE Leap 15.5:python-gdbm-2.7.18-150000.68.1 openSUSE Leap 15.5:python-idle-2.7.18-150000.68.1 openSUSE Leap 15.5:python-tk-2.7.18-150000.68.1 openSUSE Leap 15.5:python-xml-2.7.18-150000.68.1 openSUSE Leap 15.6:libpython2_7-1_0-2.7.18-150000.68.1 openSUSE Leap 15.6:libpython2_7-1_0-32bit-2.7.18-150000.68.1 openSUSE Leap 15.6:python-2.7.18-150000.68.1 openSUSE Leap 15.6:python-32bit-2.7.18-150000.68.1 openSUSE Leap 15.6:python-base-2.7.18-150000.68.1 openSUSE Leap 15.6:python-base-32bit-2.7.18-150000.68.1 openSUSE Leap 15.6:python-curses-2.7.18-150000.68.1 openSUSE Leap 15.6:python-demo-2.7.18-150000.68.1 openSUSE Leap 15.6:python-devel-2.7.18-150000.68.1 openSUSE Leap 15.6:python-doc-2.7.18-150000.68.1 openSUSE Leap 15.6:python-doc-pdf-2.7.18-150000.68.1 openSUSE Leap 15.6:python-gdbm-2.7.18-150000.68.1 openSUSE Leap 15.6:python-idle-2.7.18-150000.68.1 openSUSE Leap 15.6:python-tk-2.7.18-150000.68.1 openSUSE Leap 15.6:python-xml-2.7.18-150000.68.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20244151-1/ https://www.suse.com/security/cve/CVE-2024-11168.html CVE-2024-11168 https://bugzilla.suse.com/1233307 SUSE Bug 1233307