CVE-2016-0772

The smtplib library in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 does not return an error when StartTLS fails, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."

The smtplib library in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 does not return an error when StartTLS fails, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."

Updated python and python3 packages fixes security vulnerability:

• Heap overflow in zipimporter module (CVE-2016-5636).
• HTTP header injection in urrlib2/urllib/httplib/http.client (CVE-2016-5699).
• smtplib StartTLS stripping attack (CVE-2016-0772).

This update for python3 to version 3.6.10 fixes the following issues:

• CVE-2017-18207: Fixed a denial of service in Wave_read._read_fmt_chunk() (bsc#1083507).
• CVE-2019-16056: Fixed an issue where email parsing could fail for multiple @ (bsc#1149955).
• CVE-2019-15903: Fixed a heap-based buffer over-read in libexpat (bsc#1149429).

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the python-doc-2.7.12-1.3 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python-2.7.12-1.5 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libpython2_7-1_0-2.7.12-1.4 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python36-3.6.15-1.1 package on the GA media of openSUSE Tumbleweed.

The smtplib library in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 does not return an error when StartTLS fails, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."

This update for python fixes the following issues:

• CVE-2016-0772: smtplib vulnerability opens startTLS stripping attack (bsc#984751)
• CVE-2016-5636: heap overflow when importing malformed zip files (bsc#985177)
• CVE-2016-5699: incorrect validation of HTTP headers allow header injection (bsc#985348)
• CVE-2016-1000110: HTTPoxy vulnerability in urllib, fixed by disregarding HTTP_PROXY when REQUEST_METHOD is also set (bsc#989523)

This update for python fixes the following issues:

• CVE-2016-0772: smtplib vulnerability opens startTLS stripping attack (bsc#984751)
• CVE-2016-5699: incorrect validation of HTTP headers allow header injection (bsc#985348)
• CVE-2016-1000110: HTTPoxy vulnerability in urllib, fixed by disregarding HTTP_PROXY when REQUEST_METHOD is also set (bsc#989523)

This update provides Python 3.4.5, which brings many fixes and enhancements.

The following security issues have been fixed:

• CVE-2016-1000110: CGIHandler could have allowed setting of HTTP_PROXY environment variable based on user supplied Proxy request header. (bsc#989523)
• CVE-2016-0772: A vulnerability in smtplib could have allowed a MITM attacker to perform a startTLS stripping attack. (bsc#984751)
• CVE-2016-5636: A heap overflow in Python's zipimport module. (bsc#985177)
• CVE-2016-5699: A header injection flaw in urrlib2/urllib/httplib/http.client. (bsc#985348)

The update also includes the following non-security fixes:

• Don't force 3rd party C extensions to be built with -Werror=declaration-after-statement. (bsc#951166)
• Make urllib proxy var handling behave as usual on POSIX. (bsc#983582)

For a comprehensive list of changes please refer to the upstream change log: https://docs.python.org/3.4/whatsnew/changelog.html

This update provides Python 3.4.5, which brings many fixes and enhancements.

The following security issues have been fixed:

• CVE-2016-1000110: CGIHandler could have allowed setting of HTTP_PROXY environment variable based on user supplied Proxy request header. (bsc#989523)
• CVE-2016-0772: A vulnerability in smtplib could have allowed a MITM attacker to perform a startTLS stripping attack. (bsc#984751)
• CVE-2016-5636: A heap overflow in Python's zipimport module. (bsc#985177)
• CVE-2016-5699: A header injection flaw in urrlib2/urllib/httplib/http.client. (bsc#985348)

The update also includes the following non-security fixes:

• Don't force 3rd party C extensions to be built with -Werror=declaration-after-statement. (bsc#951166)
• Make urllib proxy var handling behave as usual on POSIX. (bsc#983582)

For a comprehensive list of changes please refer to the upstream change log: https://docs.python.org/3.4/whatsnew/changelog.html

This update for python fixes the following issues:

Security issues fixed:

• CVE-2016-0772: smtplib vulnerability opens startTLS stripping attack (bsc#984751)
• CVE-2016-5636: heap overflow when importing malformed zip files (bsc#985177)
• CVE-2016-5699: incorrect validation of HTTP headers allow header injection (bsc#985348)
• CVE-2016-1000110: HTTPoxy vulnerability in urllib, fixed by disregarding HTTP_PROXY when REQUEST_METHOD is also set (bsc#989523)
• CVE-2019-5010: Fixed a denial-of-service vulnerability in the X509 certificate parser (bsc#1122191)

This update for python3 to version 3.6.10 fixes the following issues:

• CVE-2017-18207: Fixed a denial of service in Wave_read._read_fmt_chunk() (bsc#1083507).
• CVE-2019-16056: Fixed an issue where email parsing could fail for multiple @ (bsc#1149955).
• CVE-2019-15903: Fixed a heap-based buffer over-read in libexpat (bsc#1149429).

This update for python fixes the following issues:

Updated to version 2.7.17 to unify packages among openSUSE:Factory and SLE versions (bsc#1159035).

It was discovered that the smtplib library in Python did not return an error when StartTLS fails. A remote attacker could possibly use this to expose sensitive information. (CVE-2016-0772)

Rémi Rampin discovered that Python would not protect CGI applications from contents of the HTTP_PROXY environment variable when based on the contents of the Proxy header from HTTP requests. A remote attacker could possibly use this to cause a CGI application to redirect outgoing HTTP requests. (CVE-2016-1000110)

Insu Yun discovered an integer overflow in the zipimporter module in Python that could lead to a heap-based overflow. An attacker could use this to craft a special zip file that when read by Python could possibly execute arbitrary code. (CVE-2016-5636)

Guido Vranken discovered that the urllib modules in Python did not properly handle carriage return line feed (CRLF) in headers. A remote attacker could use this to craft URLs that inject arbitrary HTTP headers. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2016-5699)