CVE-2019-9740

An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic data types, and dynamic typing.

Security Fix(es):

• numpy: crafted serialized object passed in numpy.load() in pickle python module allows arbitrary code execution (CVE-2019-6446)

• python: CRLF injection via the query part of the url passed to urlopen() (CVE-2019-9740)

• python: CRLF injection via the path part of the url passed to urlopen() (CVE-2019-9947)

• python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms (CVE-2019-9948)

• python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on internal service (CVE-2019-11236)

• python-urllib3: Certification mishandle when error should be thrown (CVE-2019-11324)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.1 Release Notes linked from the References section.

An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic data types, and dynamic typing.

Security Fix(es):

• numpy: crafted serialized object passed in numpy.load() in pickle python module allows arbitrary code execution (CVE-2019-6446)

• python: CRLF injection via the query part of the url passed to urlopen() (CVE-2019-9740)

• python: CRLF injection via the path part of the url passed to urlopen() (CVE-2019-9947)

• python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms (CVE-2019-9948)

• python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on internal service (CVE-2019-11236)

• python-urllib3: Certification mishandle when error should be thrown (CVE-2019-11324)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• CVE-2019-9740: reject control characters in HTTP URL paths in httplib.HTTPConnection.putrequest to prevent CRLF header injection
• CVE-2019-18348: reject control characters in hostnames in httplib.HTTPConnection.init via a new _validate_host helper to prevent CRLF header injection (the glibc CVE-2016-10739 mitigation shipped on RHEL 7+ is not present on CentOS 6 / Oracle Linux 6 ELS)
• CVE-2018-1000030: cache the readahead buffer thread-locally inside file_iternext to fix heap buffer corruption and crashes when multiple threads iterate over the same file object

• CVE-2019-9740: reject control characters in HTTP URL paths in httplib.HTTPConnection.putrequest to prevent CRLF header injection
• CVE-2019-18348: reject control characters in hostnames in httplib.HTTPConnection.init via a new _validate_host helper to prevent CRLF header injection (the glibc CVE-2016-10739 mitigation shipped on RHEL 7+ is not present on CentOS 6 / Oracle Linux 6 ELS)
• CVE-2018-1000030: cache the readahead buffer thread-locally inside file_iternext to fix heap buffer corruption and crashes when multiple threads iterate over the same file object

Updated python and python3 packages fix security vulnerabilities:

An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.2. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n followed by an HTTP header or a Redis command (CVE-2019-9740).

An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.2. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the path component of a URL) followed by an HTTP header or a Redis command. This is similar to CVE-2019-9740 query string issue (CVE-2019-9947).

urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call (CVE-2019-9948).

A security regression of CVE-2019-9636 was discovered in python, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application (CVE-2019-10160).

It was discovered that Python incorrectly parsed certain email addresses. A remote attacker could possibly use this issue to trick Python applications into accepting email addresses that should be denied (CVE-2019-16056).

It was discovered that the Python documentation XML-RPC server incorrectly handled certain fields. A remote attacker could use this issue to execute a cross-site scripting (XSS) attack (CVE-2019-16935).

This update for python-urllib3 fixes the following issues:

Security issues fixed:

• CVE-2019-9740: Fixed CRLF injection issue (bsc#1129071).
• CVE-2019-11324: Fixed invalid CA certificat verification (bsc#1132900).
• CVE-2019-11236: Fixed CRLF injection via request parameter (bsc#1132663).
• CVE-2018-20060: Remove Authorization header when redirecting cross-host (bsc#1119376).

This update was imported from the SUSE:SLE-15:Update update project.

This update for python-urllib3 fixes the following issues:

Security issues fixed:

• CVE-2019-9740: Fixed CRLF injection issue (bsc#1129071).
• CVE-2019-11324: Fixed invalid CA certificat verification (bsc#1132900).
• CVE-2019-11236: Fixed CRLF injection via request parameter (bsc#1132663).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

These are all security issues fixed in the python36-CherryPy-18.6.1-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python36-urllib3-1.26.6-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-urllib3_1-1.26.15-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-urllib3-2.1.0-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-CherryPy-18.9.0-3.3 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-CherryPy-18.10.0-4.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-urllib3-2.8.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-urllib3_1-1.26.20-7.2 package on the GA media of openSUSE Tumbleweed.

An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

This feature update for venv-salt-minion provides the following changes:

• Introduce venv-salt-minion.
• Track already fixed issues.

This feature update for venv-salt-minion provides the following changes:

• Introduce venv-salt-minion.
• Mention fixed issues provided with the bundle.

This update for ardana-ansible, ardana-barbican, ardana-cinder, ardana-cluster, ardana-cobbler, ardana-db, ardana-designate, ardana-extensions-nsx, ardana-glance, ardana-heat, ardana-horizon, ardana-input-model, ardana-installer-ui, ardana-ironic, ardana-keystone, ardana-logging, ardana-magnum, ardana-monasca, ardana-mq, ardana-neutron, ardana-nova, ardana-octavia, ardana-opsconsole, ardana-opsconsole-ui, ardana-osconfig, ardana-service, ardana-ses, ardana-swift, ardana-tempest, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, java-monasca-common, java-monasca-common-kit, openstack-ceilometer, openstack-cinder, openstack-designate, openstack-heat, openstack-horizon-plugin-neutron-fwaas-ui, openstack-horizon-plugin-neutron-lbaas-ui, openstack-horizon-plugin-neutron-vpnaas-ui, openstack-ironic, openstack-ironic-python-agent, openstack-keystone, openstack-magnum, openstack-manila, openstack-monasca-notification, openstack-monasca-persister, openstack-monasca-persister-java, openstack-monasca-persister-java-kit, openstack-neutron, openstack-neutron-gbp, openstack-neutron-lbaas, openstack-nova, openstack-octavia, openstack-tempest, python-ardana-configurationprocessor, python-cinder-tempest-plugin, python-ironicclient, python-keystonemiddleware, python-monasca-tempest-plugin, python-openstackclient, python-openstacksdk, python-proliantutils, python-python-engineio, python-swiftlm, python-vmware-nsx, python-vmware-nsxlib, yast2-crowbar fixes the following issues:

• Update to version 9.0+git.1566374020.301191f:

  • Use raw image format when using SES backend on Nova (SOC-9285)

• Update to version 9.0+git.1563375514.31fa9a7:

  • Ensure ardana-update-pkgs works for dist-upgrade (SOC-9857)

• Update to version 9.0+git.1563192450.30e8f16:

  • Ensure Cloud8/SLE-12-SP3 repps still served (SOC-9840)

• Update to version 9.0+git.1566251498.be02ca4:

  • adds ipv6 format to http/https urls (SOC-10063)

• Update to version 9.0+git.1565678764.c3a9b9f:

  • adds ipv6 format to urls (SOC-10063)

• Update to version 9.0+git.1562898832.1731f25:

  • FIX broken symlink for policy.yaml.j2. (SOC-0000)

• Update to version 9.0+git.1559333871.40508f7:

  • Allow system to bind to non local ipv6 addresses (SOC-9330)

• Update to version 9.0+git.1566336494.93967dd:

  • Using python netaddr for ipv6 address comparison (SOC-9940)

• Update to version 9.0+git.1564409964.b7e4fc3:

  • Don't use 'latest' with 'zypper' (SOC-9997)

• Update to version 9.0+git.1562182567.aef23e0:

  • Format curl commands for ipv6 (SOC-9369)

• Update to version 9.0+git.1565680593.df7a432:

  • adds ipv6 format to urls (SOC-10063)

• Update to version 9.0+git.1566213657.69862ab:

  • Add missing service plugin for l2gw (SOC-5837)

• Update to version 9.0+git.1563904379.31ff1e9:

  • Add the NSX-T L2-Gateway Service definition (SOC-5837)

• Switch to new Gerrit Server

• Update to version 9.0+git.1566375806.f0b2333:

  • Configure glance image_direct_url/multiple_locations (SOC-9285)

• Update to version 9.0+git.1565720518.c7fdca2:

  • adds ipv6 format to urls (SOC-10063)

• Update to version 9.0+git.1564491141.602fdf9:

  • Default glance_default_store to rbd if SES enabled (SOC-8749)

• Update to version 9.0+git.1565721273.f44b8d7:

  • adds ipv6 format to urls (SOC-10063)

• Update to version 9.0+git.1565891518.2a545a1:

  • adds ipv6 format to urls (SOC-10063)

• Update to version 9.0+git.1565655129.ab3a58c:

  • Removed None condition from rule (SOC-10003)

• Update to version 9.0+git.1564609155.033a963:

  • Updated heat_policy.json permission to be 664 (SOC-9872)

• Update to version 9.0+git.1562848565.91e75b2:

  • Include memcached in the minimal ardana-ci model (SOC-9800)

• Update to version 9.0+git.1566255088.3443670:

  • Add server state column (SOC-9957)

• Update to version 9.0+git.1565218199.868c5d1:

  • Add ipv6 support (SOC-9677) (#357)

• Update to version 9.0+git.1563912815.7090c20:

  • Only show ses config upload option when ses is not configured (SOC-8555)…

This update for python-urllib3 fixes the following issues:

Security issues fixed:

• CVE-2019-9740: Fixed CRLF injection issue (bsc#1129071).
• CVE-2019-11324: Fixed invalid CA certificat verification (bsc#1132900).
• CVE-2019-11236: Fixed CRLF injection via request parameter (bsc#1132663).
• CVE-2018-20060: Remove Authorization header when redirecting cross-host (bsc#1119376).

This update for python-urllib3 fixes the following issues:

Security issues fixed:

• CVE-2019-9740: Fixed CRLF injection issue (bsc#1129071).
• CVE-2019-11324: Fixed invalid CA certificat verification (bsc#1132900).
• CVE-2019-11236: Fixed CRLF injection via request parameter (bsc#1132663).
• CVE-2018-20060: Remove Authorization header when redirecting cross-host (bsc#1119376).

This update for python-urllib3 fixes the following issues:

Security issues fixed:

• CVE-2019-9740: Fixed CRLF injection issue (bsc#1129071).
• CVE-2019-11324: Fixed invalid CA certificat verification (bsc#1132900).
• CVE-2019-11236: Fixed CRLF injection via request parameter (bsc#1132663).

This update for python-urllib3 fixes the following issues:

Security issues fixed:

• CVE-2019-9740: Fixed CRLF injection issue (bsc#1129071).
• CVE-2019-11324: Fixed invalid CA certificat verification (bsc#1132900).
• CVE-2019-11236: Fixed CRLF injection via request parameter (bsc#1132663).
• CVE-2018-20060: Remove Authorization header when redirecting cross-host (bsc#1119376).

This update for python-urllib3 fixes the following issues:

Security issues fixed:

• CVE-2019-9740: Fixed CRLF injection issue (bsc#1129071).
• CVE-2019-11324: Fixed invalid CA certificat verification (bsc#1132900).
• CVE-2019-11236: Fixed CRLF injection via request parameter (bsc#1132663).

This update for python-urllib3 fixes the following issues:

Security issues fixed:

• CVE-2019-9740: Fixed CRLF injection issue (bsc#1129071).
• CVE-2019-11236: Fixed CRLF injection via request parameter (bsc#1132663).
• CVE-2018-20060: Remove Authorization header when redirecting cross-host (bsc#1119376).

This update for crowbar-openstack, grafana, influxdb, python-urllib3 contains the following fixes:

Security fixes included in this update:

openstack-glance

• CVE-2016-8611: Added rate limiting for glance api (bnc#1005886)

grafana

• CVE-2020-24303: Fixed an XSS via a query alias for the ElasticSearch datasource (#bnc#1178243)

influxdb

• CVE-2019-20933: Fixed an authentication bypass (bnc#1178988)

python-urlib3

• CVE-2019-9740: Fixed a CRLF injection in urllib3 (bnc#1129071).
• CVE-2020-26137: Fixed a CRLF injection via HTTP request method (bnc#1177120)

memcached

• CVE-2018-1000115: Fixed a issue where a UDP server allowed spoofed traffic amplification DoS (bnc#1083903).

Non-security fixes included in this update:

Changes in crowbar-openstack:

• Update to version 4.0+git.1604938545.30c10db18:
  • rabbitmq: Fix crm running check (SOC-11240)

Changes in grafana:

• Fix bnc#1178243 CVE-2020-24303 by adding 25401-Fix-XSS-vulnerability-with-series-overrides.patch

Changes in influxdb:

• Add CVE-2019-20933.patch (bnc#1178988, CVE-2019-20933) to fix authentication bypass_

• Declare license files correctly

• Version 1.2.4:

  • The stress tool influx_stress will be removed in a subsequent release.
  • Remove the override of GOMAXPROCS.
  • Uncomment section headers from the default configuration file.
  • Improve write performance significantly.
  • Prune data in meta store for deleted shards.
  • Update latest dependencies with Godeps.
  • Introduce syntax for marking a partial response with chunking.
  • Use X-Forwarded-For IP address in HTTP logger if present.
  • Add support for secure transmission via collectd.
  • Switch logging to use structured logging everywhere.
  • [CLI feature request] USE retention policy for queries.
  • Add clear command to cli.
  • Adding ability to use parameters in queries in the v2 client using the Parameters map in the Query struct.
  • Allow add items to array config via ENV
  • Support subquery execution in the query language.
  • Verbose output for SSL connection errors.
  • Cache snapshotting performance improvements

• Partially revert previous change to fix build for Leap

Changes in python-urllib3:

• Update urllib3-fix-test-urls.patch. Adjust to match upstream solution.

• Add urllib3-fix-test-urls.patch. Fix tests failing on python checks for CVE-2019-9740.

• Add urllib3-cve-2020-26137.patch. Don't allow control chars in request method. (bnc#1177120, CVE-2020-26137)

It was discovered that Python incorrectly handled certain pickle files. An attacker could possibly use this issue to consume memory, leading to a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2018-20406)

It was discovered that Python incorrectly validated the domain when handling cookies. An attacker could possibly trick Python into sending cookies to the wrong domain. (CVE-2018-20852)

Jonathan Birch and Panayiotis Panayiotou discovered that Python incorrectly handled Unicode encoding during NFKC normalization. An attacker could possibly use this issue to obtain sensitive information. (CVE-2019-9636, CVE-2019-10160)

Colin Read and Nicolas Edet discovered that Python incorrectly handled parsing certain X509 certificates. An attacker could possibly use this issue to cause Python to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-5010)

It was discovered that Python incorrectly handled certain urls. A remote attacker could possibly use this issue to perform CRLF injection attacks. (CVE-2019-9740, CVE-2019-9947)

Sihoon Lee discovered that Python incorrectly handled the local_file: scheme. A remote attacker could possibly use this issue to bypass blocklist meschanisms. (CVE-2019-9948)

USN-4127-1 fixed several vulnerabilities in Python. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.

Original advisory details:

It was discovered that Python incorrectly handled certain pickle files. An attacker could possibly use this issue to consume memory, leading to a denial of service. This issue only affected Ubuntu 14.04 ESM. (CVE-2018-20406)

It was discovered that Python incorrectly validated the domain when handling cookies. An attacker could possibly trick Python into sending cookies to the wrong domain. (CVE-2018-20852)

Jonathan Birch and Panayiotis Panayiotou discovered that Python incorrectly handled Unicode encoding during NFKC normalization. An attacker could possibly use this issue to obtain sensitive information. (CVE-2019-9636, CVE-2019-10160)

Colin Read and Nicolas Edet discovered that Python incorrectly handled parsing certain X509 certificates. An attacker could possibly use this issue to cause Python to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 ESM. (CVE-2019-5010)

It was discovered that Python incorrectly handled certain urls. A remote attacker could possibly use this issue to perform CRLF injection attacks. (CVE-2019-9740, CVE-2019-9947)

Sihoon Lee discovered that Python incorrectly handled the local_file: scheme. A remote attacker could possibly use this issue to bypass blocklist meschanisms. (CVE-2019-9948)

It was discovered that Python incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 18.04 LTS. (CVE-2015-20107)

It was discovered that Python incorrectly used regular expressions vulnerable to catastrophic backtracking. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2018-1060, CVE-2018-1061)

It was discovered that Python failed to initialize Expat’s hash salt. A remote attacker could possibly use this issue to cause hash collisions, leading to a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2018-14647)

It was discovered that Python incorrectly handled certain pickle files. An attacker could possibly use this issue to consume memory, leading to a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2018-20406)

It was discovered that Python incorrectly validated the domain when handling cookies. An attacker could possibly trick Python into sending cookies to the wrong domain. This issue only affected Ubuntu 14.04 LTS. (CVE-2018-20852)

Jonathan Birch and Panayiotis Panayiotou discovered that Python incorrectly handled Unicode encoding during NFKC normalization. An attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 14.04 LTS. (CVE-2019-9636, CVE-2019-10160)

It was discovered that Python incorrectly parsed certain email addresses. A remote attacker could possibly use this issue to trick Python applications into accepting email addresses that should be denied. This issue only affected Ubuntu 14.04 LTS. (CVE-2019-16056)

It was discovered that the Python documentation XML-RPC server incorrectly handled certain fields. A remote attacker could use this issue to execute a cross-site scripting (XSS) attack. This issue only affected Ubuntu 14.04 LTS. (CVE-2019-16935)

It was discovered that Python documentation had a misleading information. A security issue could be possibly caused by wrong assumptions of this information. This issue only affected Ubuntu 14.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-17514)

It was discovered that Python incorrectly stripped certain characters from requests. A remote attacker could use this issue to perform CRLF injection. This issue only affected Ubuntu 14.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-18348)

It was discovered that Python incorrectly handled certain TAR archives. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-20907)

Colin Read and Nicolas Edet discovered that Python incorrectly handled parsing certain X509 certificates. An attacker could possibly use this issue to cause Python to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2019-5010)

It was discovered that incorrectly handled certain ZIP files. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2019-9674)

It was discovered that Python incorrectly handled certain urls. A remote attacker could possibly use this issue to perform CRLF injection attacks. This issue only affected Ubuntu 14.04 LTS. (CVE-2019-9740, CVE-2019-9947)

Sihoon Lee discovered that Python incorrectly handled the local_file: scheme. A remote attacker could possibly use this issue to bypass blocklist meschanisms. This issue only affected Ubuntu 14.04 LTS. (CVE-2019-9948)

It was discovered that Python incorrectly handled certain IP values. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 18.04 LTS. (CVE-2020-14422)

It was discovered that Python incorrectly handled certain character sequences. A remote attacker could possibly use this issue to perform CRLF injection. This issue only affected Ubuntu 14.04 LTS and Ubuntu…