ALAS-2016-741


Amazon Linux AMI Security Advisory: ALAS-2016-741
Advisory Release Date: 2016-09-01 18:00 Pacific
Severity: Medium
References: CVE-2016-1000110 

Issue Overview:

It was discovered that the Python CGIHandler class did not properly protect against the HTTP_PROXY variable name clash in a CGI context. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a Python CGI script to an attacker-controlled proxy via a malicious HTTP request.


Affected Packages:

python34,python27,python26


Issue Correction:
Run yum update python34 to update your system.
Run yum update python27 to update your system.
Run yum update python26 to update your system.

New Packages:
i686:
    python27-libs-2.7.12-2.120.amzn1.i686
    python27-test-2.7.12-2.120.amzn1.i686
    python27-2.7.12-2.120.amzn1.i686
    python27-devel-2.7.12-2.120.amzn1.i686
    python27-tools-2.7.12-2.120.amzn1.i686
    python27-debuginfo-2.7.12-2.120.amzn1.i686
    python26-test-2.6.9-2.88.amzn1.i686
    python26-libs-2.6.9-2.88.amzn1.i686
    python26-debuginfo-2.6.9-2.88.amzn1.i686
    python26-devel-2.6.9-2.88.amzn1.i686
    python26-tools-2.6.9-2.88.amzn1.i686
    python26-2.6.9-2.88.amzn1.i686
    python34-devel-3.4.3-1.33.amzn1.i686
    python34-debuginfo-3.4.3-1.33.amzn1.i686
    python34-test-3.4.3-1.33.amzn1.i686
    python34-libs-3.4.3-1.33.amzn1.i686
    python34-tools-3.4.3-1.33.amzn1.i686
    python34-3.4.3-1.33.amzn1.i686

src:
    python27-2.7.12-2.120.amzn1.src
    python26-2.6.9-2.88.amzn1.src
    python34-3.4.3-1.33.amzn1.src

x86_64:
    python27-debuginfo-2.7.12-2.120.amzn1.x86_64
    python27-libs-2.7.12-2.120.amzn1.x86_64
    python27-tools-2.7.12-2.120.amzn1.x86_64
    python27-2.7.12-2.120.amzn1.x86_64
    python27-devel-2.7.12-2.120.amzn1.x86_64
    python27-test-2.7.12-2.120.amzn1.x86_64
    python26-libs-2.6.9-2.88.amzn1.x86_64
    python26-tools-2.6.9-2.88.amzn1.x86_64
    python26-debuginfo-2.6.9-2.88.amzn1.x86_64
    python26-2.6.9-2.88.amzn1.x86_64
    python26-test-2.6.9-2.88.amzn1.x86_64
    python26-devel-2.6.9-2.88.amzn1.x86_64
    python34-tools-3.4.3-1.33.amzn1.x86_64
    python34-libs-3.4.3-1.33.amzn1.x86_64
    python34-debuginfo-3.4.3-1.33.amzn1.x86_64
    python34-devel-3.4.3-1.33.amzn1.x86_64
    python34-test-3.4.3-1.33.amzn1.x86_64
    python34-3.4.3-1.33.amzn1.x86_64