ALAS2-2020-1484


Amazon Linux 2 Security Advisory: ALAS-2020-1484
Advisory Release Date: 2020-09-01 00:40 Pacific
Advisory Updated Date: 2020-09-02 17:56 Pacific
Severity: Medium

Issue Overview:

Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this attacker can cause many dictionary entries to be created. A vulnerability was found in the way the ipaddress python module computes hash values in the IPv4Interface and IPv6Interface classes. This flaw allows an attacker to create many dictionary entries, due to the performance of a dictionary containing the IPv4Interface or IPv6Interface objects, possibly resulting in a denial of service. The highest threat from this vulnerability is to system availability. (CVE-2020-14422 )

In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation. (CVE-2019-20907 )


Affected Packages:

python3


Issue Correction:
Run yum update python3 to update your system.

New Packages:
aarch64:
    python3-3.7.9-1.amzn2.0.1.aarch64
    python3-libs-3.7.9-1.amzn2.0.1.aarch64
    python3-devel-3.7.9-1.amzn2.0.1.aarch64
    python3-tools-3.7.9-1.amzn2.0.1.aarch64
    python3-tkinter-3.7.9-1.amzn2.0.1.aarch64
    python3-test-3.7.9-1.amzn2.0.1.aarch64
    python3-debug-3.7.9-1.amzn2.0.1.aarch64
    python3-debuginfo-3.7.9-1.amzn2.0.1.aarch64

i686:
    python3-3.7.9-1.amzn2.0.1.i686
    python3-libs-3.7.9-1.amzn2.0.1.i686
    python3-devel-3.7.9-1.amzn2.0.1.i686
    python3-tools-3.7.9-1.amzn2.0.1.i686
    python3-tkinter-3.7.9-1.amzn2.0.1.i686
    python3-test-3.7.9-1.amzn2.0.1.i686
    python3-debug-3.7.9-1.amzn2.0.1.i686
    python3-debuginfo-3.7.9-1.amzn2.0.1.i686

src:
    python3-3.7.9-1.amzn2.0.1.src

x86_64:
    python3-3.7.9-1.amzn2.0.1.x86_64
    python3-libs-3.7.9-1.amzn2.0.1.x86_64
    python3-devel-3.7.9-1.amzn2.0.1.x86_64
    python3-tools-3.7.9-1.amzn2.0.1.x86_64
    python3-tkinter-3.7.9-1.amzn2.0.1.x86_64
    python3-test-3.7.9-1.amzn2.0.1.x86_64
    python3-debug-3.7.9-1.amzn2.0.1.x86_64
    python3-debuginfo-3.7.9-1.amzn2.0.1.x86_64