Issued:
2005-02-15
Updated:
2005-02-15

RHSA-2005:108 - Security Advisory

Synopsis

python security update

Type/Severity

Security Advisory: Important

Topic

Updated Python packages that fix several security issues are now available
for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red
Hat Security Response Team

Description

Python is an interpreted, interactive, object-oriented programming language.

An object traversal bug was found in the Python SimpleXMLRPCServer. This
bug could allow a remote untrusted user to do unrestricted object traversal
and allow them to access or change function internals using the im_* and
func_* attributes. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2005-0089 to this issue.

Users of Python are advised to upgrade to these updated packages, which
contain backported patches to correct these issues.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:

up2date

For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:

http://www.redhat.com/docs/manuals/enterprise/

Affected Products

  • Red Hat Enterprise Linux Server 4 x86_64
  • Red Hat Enterprise Linux Server 4 ia64
  • Red Hat Enterprise Linux Server 4 i386
  • Red Hat Enterprise Linux Workstation 4 x86_64
  • Red Hat Enterprise Linux Workstation 4 ia64
  • Red Hat Enterprise Linux Workstation 4 i386
  • Red Hat Enterprise Linux Desktop 4 x86_64
  • Red Hat Enterprise Linux Desktop 4 i386
  • Red Hat Enterprise Linux for IBM z Systems 4 s390x
  • Red Hat Enterprise Linux for IBM z Systems 4 s390
  • Red Hat Enterprise Linux for Power, big endian 4 ppc

Fixes

  • BZ - 146649 - CAN-2005-0089 python SimpleXMLRPCServer security issue

CVEs

References

Red Hat Enterprise Linux Server 4

SRPM
python-2.3.4-14.1.src.rpm SHA-256: cb100d53f994c0b64aa784e69d54ef3279c459fca7078671acc4130685593fff
x86_64
python-2.3.4-14.1.x86_64.rpm SHA-256: 2c505a16fabc26da9e1b5c3824e74e932a285652aa76716fba1026c391b032a0
python-2.3.4-14.1.x86_64.rpm SHA-256: 2c505a16fabc26da9e1b5c3824e74e932a285652aa76716fba1026c391b032a0
python-devel-2.3.4-14.1.x86_64.rpm SHA-256: 9e32bda2bd41bd90125e1dcac8551ec8fe967b60e7bd3e43feac7c6bb01e05c2
python-devel-2.3.4-14.1.x86_64.rpm SHA-256: 9e32bda2bd41bd90125e1dcac8551ec8fe967b60e7bd3e43feac7c6bb01e05c2
python-docs-2.3.4-14.1.x86_64.rpm SHA-256: 94d95b82605ff42ea75473c13e52c251e7c71dc613b9fa472dc5520cdd6ad7ca
python-docs-2.3.4-14.1.x86_64.rpm SHA-256: 94d95b82605ff42ea75473c13e52c251e7c71dc613b9fa472dc5520cdd6ad7ca
python-tools-2.3.4-14.1.x86_64.rpm SHA-256: e9347917668b78cdbee9064b4b10200304e2c7c99a44b2fa18fa4daaa6d98dc9
python-tools-2.3.4-14.1.x86_64.rpm SHA-256: e9347917668b78cdbee9064b4b10200304e2c7c99a44b2fa18fa4daaa6d98dc9
tkinter-2.3.4-14.1.x86_64.rpm SHA-256: 026aac61f921b9bdf3505af54073e6ba8a85777dfddb26cbd7cbbff94d25bec8
tkinter-2.3.4-14.1.x86_64.rpm SHA-256: 026aac61f921b9bdf3505af54073e6ba8a85777dfddb26cbd7cbbff94d25bec8
ia64
python-2.3.4-14.1.ia64.rpm SHA-256: a5f8d2e0269ecd0d7bbd5e9bf6389f262ae81ef69434bf856905041434d07389
python-2.3.4-14.1.ia64.rpm SHA-256: a5f8d2e0269ecd0d7bbd5e9bf6389f262ae81ef69434bf856905041434d07389
python-devel-2.3.4-14.1.ia64.rpm SHA-256: 5dbab0ebad6819f685e0f9f377301e533e2e64cff5890c4b0cf280d5f24995cf
python-devel-2.3.4-14.1.ia64.rpm SHA-256: 5dbab0ebad6819f685e0f9f377301e533e2e64cff5890c4b0cf280d5f24995cf
python-docs-2.3.4-14.1.ia64.rpm SHA-256: 42a74626f612d37fb2ca4bb274b1a6e1bde651c520087807fbc7e739cfcafcdd
python-docs-2.3.4-14.1.ia64.rpm SHA-256: 42a74626f612d37fb2ca4bb274b1a6e1bde651c520087807fbc7e739cfcafcdd
python-tools-2.3.4-14.1.ia64.rpm SHA-256: 7d3cac2a2cae453c882c661832d8e8bbe00cc2a3c0bc878c42122be605793eb1
python-tools-2.3.4-14.1.ia64.rpm SHA-256: 7d3cac2a2cae453c882c661832d8e8bbe00cc2a3c0bc878c42122be605793eb1
tkinter-2.3.4-14.1.ia64.rpm SHA-256: 9004a6a5d8a4bd16c387a102f9eabce1b908baa17dd23809b0682eae260ab044
tkinter-2.3.4-14.1.ia64.rpm SHA-256: 9004a6a5d8a4bd16c387a102f9eabce1b908baa17dd23809b0682eae260ab044
i386
python-2.3.4-14.1.i386.rpm SHA-256: 54df389b7343e12c18737829bc7728882591146447e82d8cac699673f184083b
python-2.3.4-14.1.i386.rpm SHA-256: 54df389b7343e12c18737829bc7728882591146447e82d8cac699673f184083b
python-devel-2.3.4-14.1.i386.rpm SHA-256: 702df509025b81535820a9c88f3e07b8dea85e1c5cb9a3e7c852188134d061ec
python-devel-2.3.4-14.1.i386.rpm SHA-256: 702df509025b81535820a9c88f3e07b8dea85e1c5cb9a3e7c852188134d061ec
python-docs-2.3.4-14.1.i386.rpm SHA-256: 5578b957734c9f638b32baa6d51746f1addeee6640d954e3f66193ae6f224482
python-docs-2.3.4-14.1.i386.rpm SHA-256: 5578b957734c9f638b32baa6d51746f1addeee6640d954e3f66193ae6f224482
python-tools-2.3.4-14.1.i386.rpm SHA-256: d163780223516b7b0eab712d6b134a772b439a6dd759924a1ed7d14863f4adf7
python-tools-2.3.4-14.1.i386.rpm SHA-256: d163780223516b7b0eab712d6b134a772b439a6dd759924a1ed7d14863f4adf7
tkinter-2.3.4-14.1.i386.rpm SHA-256: 148ea7d8339607a6b87ce292392d35cbe707dd9775f92881200b809bee0ac313
tkinter-2.3.4-14.1.i386.rpm SHA-256: 148ea7d8339607a6b87ce292392d35cbe707dd9775f92881200b809bee0ac313

Red Hat Enterprise Linux Workstation 4

SRPM
python-2.3.4-14.1.src.rpm SHA-256: cb100d53f994c0b64aa784e69d54ef3279c459fca7078671acc4130685593fff
x86_64
python-2.3.4-14.1.x86_64.rpm SHA-256: 2c505a16fabc26da9e1b5c3824e74e932a285652aa76716fba1026c391b032a0
python-devel-2.3.4-14.1.x86_64.rpm SHA-256: 9e32bda2bd41bd90125e1dcac8551ec8fe967b60e7bd3e43feac7c6bb01e05c2
python-docs-2.3.4-14.1.x86_64.rpm SHA-256: 94d95b82605ff42ea75473c13e52c251e7c71dc613b9fa472dc5520cdd6ad7ca
python-tools-2.3.4-14.1.x86_64.rpm SHA-256: e9347917668b78cdbee9064b4b10200304e2c7c99a44b2fa18fa4daaa6d98dc9
tkinter-2.3.4-14.1.x86_64.rpm SHA-256: 026aac61f921b9bdf3505af54073e6ba8a85777dfddb26cbd7cbbff94d25bec8
ia64
python-2.3.4-14.1.ia64.rpm SHA-256: a5f8d2e0269ecd0d7bbd5e9bf6389f262ae81ef69434bf856905041434d07389
python-devel-2.3.4-14.1.ia64.rpm SHA-256: 5dbab0ebad6819f685e0f9f377301e533e2e64cff5890c4b0cf280d5f24995cf
python-docs-2.3.4-14.1.ia64.rpm SHA-256: 42a74626f612d37fb2ca4bb274b1a6e1bde651c520087807fbc7e739cfcafcdd
python-tools-2.3.4-14.1.ia64.rpm SHA-256: 7d3cac2a2cae453c882c661832d8e8bbe00cc2a3c0bc878c42122be605793eb1
tkinter-2.3.4-14.1.ia64.rpm SHA-256: 9004a6a5d8a4bd16c387a102f9eabce1b908baa17dd23809b0682eae260ab044
i386
python-2.3.4-14.1.i386.rpm SHA-256: 54df389b7343e12c18737829bc7728882591146447e82d8cac699673f184083b
python-devel-2.3.4-14.1.i386.rpm SHA-256: 702df509025b81535820a9c88f3e07b8dea85e1c5cb9a3e7c852188134d061ec
python-docs-2.3.4-14.1.i386.rpm SHA-256: 5578b957734c9f638b32baa6d51746f1addeee6640d954e3f66193ae6f224482
python-tools-2.3.4-14.1.i386.rpm SHA-256: d163780223516b7b0eab712d6b134a772b439a6dd759924a1ed7d14863f4adf7
tkinter-2.3.4-14.1.i386.rpm SHA-256: 148ea7d8339607a6b87ce292392d35cbe707dd9775f92881200b809bee0ac313

Red Hat Enterprise Linux Desktop 4

SRPM
python-2.3.4-14.1.src.rpm SHA-256: cb100d53f994c0b64aa784e69d54ef3279c459fca7078671acc4130685593fff
x86_64
python-2.3.4-14.1.x86_64.rpm SHA-256: 2c505a16fabc26da9e1b5c3824e74e932a285652aa76716fba1026c391b032a0
python-devel-2.3.4-14.1.x86_64.rpm SHA-256: 9e32bda2bd41bd90125e1dcac8551ec8fe967b60e7bd3e43feac7c6bb01e05c2
python-docs-2.3.4-14.1.x86_64.rpm SHA-256: 94d95b82605ff42ea75473c13e52c251e7c71dc613b9fa472dc5520cdd6ad7ca
python-tools-2.3.4-14.1.x86_64.rpm SHA-256: e9347917668b78cdbee9064b4b10200304e2c7c99a44b2fa18fa4daaa6d98dc9
tkinter-2.3.4-14.1.x86_64.rpm SHA-256: 026aac61f921b9bdf3505af54073e6ba8a85777dfddb26cbd7cbbff94d25bec8
i386
python-2.3.4-14.1.i386.rpm SHA-256: 54df389b7343e12c18737829bc7728882591146447e82d8cac699673f184083b
python-devel-2.3.4-14.1.i386.rpm SHA-256: 702df509025b81535820a9c88f3e07b8dea85e1c5cb9a3e7c852188134d061ec
python-docs-2.3.4-14.1.i386.rpm SHA-256: 5578b957734c9f638b32baa6d51746f1addeee6640d954e3f66193ae6f224482
python-tools-2.3.4-14.1.i386.rpm SHA-256: d163780223516b7b0eab712d6b134a772b439a6dd759924a1ed7d14863f4adf7
tkinter-2.3.4-14.1.i386.rpm SHA-256: 148ea7d8339607a6b87ce292392d35cbe707dd9775f92881200b809bee0ac313

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
python-2.3.4-14.1.src.rpm SHA-256: cb100d53f994c0b64aa784e69d54ef3279c459fca7078671acc4130685593fff
s390x
python-2.3.4-14.1.s390x.rpm SHA-256: 5312009aa34a363884fc1af24809545a6a957ed35a1a3cf42d4f2447a60664d4
python-devel-2.3.4-14.1.s390x.rpm SHA-256: 72a7beb72a01051f49ea03a899383319ec2576aa440b19887c6f7b030515159a
python-docs-2.3.4-14.1.s390x.rpm SHA-256: 03d0cf617367e13952ce9bf840bf15fb0e8d8b0afe36c5382e7ee5e610f811be
python-tools-2.3.4-14.1.s390x.rpm SHA-256: d07f83c1424e8e1d8441955b31e1be1cd7635b5e6b0e525d473bdd40326f3c85
tkinter-2.3.4-14.1.s390x.rpm SHA-256: 8f6d1effffffca9ea03c0f914152b67ed92bfbcc9ade7ac2c4053e79c74d002d
s390
python-2.3.4-14.1.s390.rpm SHA-256: b5b9eb58727e6cb3d3a745f4f569fcd8317fd02d0dba7e0a64b5884b94d2930a
python-devel-2.3.4-14.1.s390.rpm SHA-256: d80c786dbe166338c72b167f519233985728a5dc569b92dd4f1e095c16758b7e
python-docs-2.3.4-14.1.s390.rpm SHA-256: 1298bce3fef61724aac681259d48c99f1aff0d677fdc9a2d7034126e5cdc26d0
python-tools-2.3.4-14.1.s390.rpm SHA-256: 7d931bb72a3e33b9e03d61890b234cbd3aa0e09c47c2624a325bef197c48786e
tkinter-2.3.4-14.1.s390.rpm SHA-256: c8cf0bb0403ad44c0461ebfa6f3a978bef2dfe1eaa1e3b68579444b039117be8

Red Hat Enterprise Linux for Power, big endian 4

SRPM
python-2.3.4-14.1.src.rpm SHA-256: cb100d53f994c0b64aa784e69d54ef3279c459fca7078671acc4130685593fff
ppc
python-2.3.4-14.1.ppc.rpm SHA-256: f77a068bdf64265f59b92297a4ee487dc4ac2d6bb98ed0b7d13f408987e9aad8
python-devel-2.3.4-14.1.ppc.rpm SHA-256: bafed22d5baddf15f1d179ad84f9799c8404ca9e1f20c1c2a271b38c3a3070af
python-docs-2.3.4-14.1.ppc.rpm SHA-256: 10e20d0582a466b9dcba00999d95eae3b72cbb6b9a8e8e515a56f565949d93dd
python-tools-2.3.4-14.1.ppc.rpm SHA-256: fbe55814e51677c272448c4fd237fffcfc120b7bf59dee2c1cd042e2b7bb9c90
tkinter-2.3.4-14.1.ppc.rpm SHA-256: e41c586f412d486aef16673867bb49337f3582b7c5fb56e757d1a33341872939

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.