Repository 32bit  Forum
Repository 64bit  Wiki
Sun Oct 20 19:39:21 UTC 2019
patches/packages/python-2.7.17-x86_64-1_slack14.2.txz: Upgraded.
  This update fixes bugs and security issues:
  Update vendorized expat library version to 2.2.8.
  Disallow URL paths with embedded whitespace or control characters into the
  underlying http client request. Such potentially malicious header injection
  URLs now cause an httplib.InvalidURL exception to be raised.
  Avoid file reading by disallowing ``local-file://`` and ``local_file://``
  URL schemes in :func:`urllib.urlopen`, :meth:`urllib.URLopener.open` and
  :meth:`urllib.URLopener.retrieve`.
  For more information, see:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15903
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9740
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9948
  (* Security fix *)