Security update for python-setuptools SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:3566-1 Final 1 1 2020-11-30T15:57:10Z current 2020-11-30T15:57:10Z 2020-11-30T15:57:10Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for python-setuptools This update for python-setuptools fixes the following issues: - Fixed a directory traversal in _download_http_url() (bsc#1176262 CVE-2019-20916) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container bci/python:3-2020-3566,Container caasp/v4/389-ds:1.4.2-2020-3566,Container caasp/v4/k8s-sidecar:0.1.75-2020-3566,Container ses/6/cephcsi/cephcsi:latest-2020-3566,Container ses/6/rook/ceph:latest-2020-3566,Container ses/7.1/cephcsi/cephcsi:latest-2020-3566,Container ses/7.1/rook/ceph:latest-2020-3566,Container ses/7/cephcsi/cephcsi:latest-2020-3566,Container ses/7/rook/ceph:latest-2020-3566,Container suse/sles/15.3/virt-launcher:0.45.0-2020-3566,Container trento/trento-runner:latest-2020-3566,Image SLES15-SP3-BYOS-Azure-2020-3566,Image SLES15-SP3-BYOS-EC2-HVM-2020-3566,Image SLES15-SP3-BYOS-GCE-2020-3566,Image SLES15-SP3-CHOST-BYOS-Aliyun-2020-3566,Image SLES15-SP3-CHOST-BYOS-Azure-2020-3566,Image SLES15-SP3-CHOST-BYOS-EC2-2020-3566,Image SLES15-SP3-CHOST-BYOS-GCE-2020-3566,Image SLES15-SP3-CHOST-BYOS-SAP-CCloud-2020-3566,Image SLES15-SP3-EC2-ECS-HVM-2020-3566,Image SLES15-SP3-EC2-HVM-2020-3566,Image SLES15-SP3-GCE-2020-3566,Image SLES15-SP3-HPC-Azure-2020-3566,Image SLES15-SP3-HPC-BYOS-Azure-2020-3566,Image SLES15-SP3-HPC-BYOS-EC2-HVM-2020-3566,Image SLES15-SP3-HPC-BYOS-GCE-2020-3566,Image SLES15-SP3-Manager-4-2-Proxy-BYOS-Azure-2020-3566,Image SLES15-SP3-Manager-4-2-Proxy-BYOS-EC2-HVM-2020-3566,Image SLES15-SP3-Manager-4-2-Proxy-BYOS-GCE-2020-3566,Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure-2020-3566,Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM-2020-3566,Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE-2020-3566,Image SLES15-SP3-Micro-5-1-BYOS-Azure-2020-3566,Image SLES15-SP3-Micro-5-1-BYOS-EC2-HVM-2020-3566,Image SLES15-SP3-Micro-5-1-BYOS-GCE-2020-3566,Image SLES15-SP3-Micro-5-2-BYOS-Azure-2020-3566,Image SLES15-SP3-Micro-5-2-BYOS-EC2-HVM-2020-3566,Image SLES15-SP3-Micro-5-2-BYOS-GCE-2020-3566,Image SLES15-SP3-Micro-BYOS-GCE-2020-3566,Image SLES15-SP3-SAP-Azure-2020-3566,Image SLES15-SP3-SAP-Azure-LI-BYOS-Production-2020-3566,Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production-2020-3566,Image SLES15-SP3-SAP-BYOS-Azure-2020-3566,Image SLES15-SP3-SAP-BYOS-EC2-HVM-2020-3566,Image SLES15-SP3-SAP-BYOS-GCE-2020-3566,Image SLES15-SP3-SAP-EC2-HVM-2020-3566,Image SLES15-SP3-SAP-GCE-2020-3566,Image SLES15-SP3-SAPCAL-Azure-2020-3566,Image SLES15-SP3-SAPCAL-EC2-HVM-2020-3566,Image SLES15-SP3-SAPCAL-GCE-2020-3566,SUSE-2020-3566,SUSE-SLE-Module-Basesystem-15-SP1-2020-3566,SUSE-SLE-Module-Basesystem-15-SP2-2020-3566,SUSE-SLE-Module-Python2-15-SP1-2020-3566,SUSE-SLE-Module-Python2-15-SP2-2020-3566 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20203566-1/ Link for SUSE-SU-2020:3566-1 https://lists.suse.com/pipermail/sle-security-updates/2020-November/007890.html E-Mail link for SUSE-SU-2020:3566-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1176262 SUSE Bug 1176262 https://www.suse.com/security/cve/CVE-2019-20916/ SUSE CVE CVE-2019-20916 page Container bci/python:3 Container caasp/v4/389-ds:1.4.2 Container caasp/v4/k8s-sidecar:0.1.75 Container ses/6/cephcsi/cephcsi:latest Container ses/6/rook/ceph:latest Container ses/7.1/cephcsi/cephcsi:latest Container ses/7.1/rook/ceph:latest Container ses/7/cephcsi/cephcsi:latest Container ses/7/rook/ceph:latest Container suse/sles/15.3/virt-launcher:0.45.0 Container trento/trento-runner:latest Image SLES15-SP3-BYOS-Azure Image SLES15-SP3-BYOS-EC2-HVM Image SLES15-SP3-BYOS-GCE Image SLES15-SP3-CHOST-BYOS-Aliyun Image SLES15-SP3-CHOST-BYOS-Azure Image SLES15-SP3-CHOST-BYOS-EC2 Image SLES15-SP3-CHOST-BYOS-GCE Image SLES15-SP3-CHOST-BYOS-SAP-CCloud Image SLES15-SP3-EC2-ECS-HVM Image SLES15-SP3-EC2-HVM Image SLES15-SP3-GCE Image SLES15-SP3-HPC-Azure Image SLES15-SP3-HPC-BYOS-Azure Image SLES15-SP3-HPC-BYOS-EC2-HVM Image SLES15-SP3-HPC-BYOS-GCE Image SLES15-SP3-Manager-4-2-Proxy-BYOS-Azure Image SLES15-SP3-Manager-4-2-Proxy-BYOS-EC2-HVM Image SLES15-SP3-Manager-4-2-Proxy-BYOS-GCE Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE Image SLES15-SP3-Micro-5-1-BYOS-Azure Image SLES15-SP3-Micro-5-1-BYOS-EC2-HVM Image SLES15-SP3-Micro-5-1-BYOS-GCE Image SLES15-SP3-Micro-5-2-BYOS-Azure Image SLES15-SP3-Micro-5-2-BYOS-EC2-HVM Image SLES15-SP3-Micro-5-2-BYOS-GCE Image SLES15-SP3-Micro-BYOS-GCE Image SLES15-SP3-SAP-Azure Image SLES15-SP3-SAP-Azure-LI-BYOS-Production Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production Image SLES15-SP3-SAP-BYOS-Azure Image SLES15-SP3-SAP-BYOS-EC2-HVM Image SLES15-SP3-SAP-BYOS-GCE Image SLES15-SP3-SAP-EC2-HVM Image SLES15-SP3-SAP-GCE Image SLES15-SP3-SAPCAL-Azure Image SLES15-SP3-SAPCAL-EC2-HVM Image SLES15-SP3-SAPCAL-GCE SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Python 2 15 SP1 SUSE Linux Enterprise Module for Python 2 15 SP2 python3-setuptools-40.5.0-6.3.1 python2-setuptools-40.5.0-6.3.1 python2-setuptools-test-40.5.0-6.3.1 python2-setuptools-wheel-40.5.0-6.3.1 python3-setuptools-test-40.5.0-6.3.1 python3-setuptools-wheel-40.5.0-6.3.1 python3-setuptools-40.5.0-6.3.1 as a component of Container bci/python:3 python3-setuptools-40.5.0-6.3.1 as a component of Container caasp/v4/389-ds:1.4.2 python3-setuptools-40.5.0-6.3.1 as a component of Container caasp/v4/k8s-sidecar:0.1.75 python3-setuptools-40.5.0-6.3.1 as a component of Container ses/6/cephcsi/cephcsi:latest python3-setuptools-40.5.0-6.3.1 as a component of Container ses/6/rook/ceph:latest python3-setuptools-40.5.0-6.3.1 as a component of Container ses/7.1/cephcsi/cephcsi:latest python3-setuptools-40.5.0-6.3.1 as a component of Container ses/7.1/rook/ceph:latest python3-setuptools-40.5.0-6.3.1 as a component of Container ses/7/cephcsi/cephcsi:latest python3-setuptools-40.5.0-6.3.1 as a component of Container ses/7/rook/ceph:latest python3-setuptools-40.5.0-6.3.1 as a component of Container suse/sles/15.3/virt-launcher:0.45.0 python3-setuptools-40.5.0-6.3.1 as a component of Container trento/trento-runner:latest python3-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-BYOS-Azure python3-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-BYOS-EC2-HVM python3-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-BYOS-GCE python3-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-CHOST-BYOS-Aliyun python3-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-CHOST-BYOS-Azure python3-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-CHOST-BYOS-EC2 python3-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-CHOST-BYOS-GCE python3-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-CHOST-BYOS-SAP-CCloud python3-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-EC2-ECS-HVM python2-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-EC2-HVM python3-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-EC2-HVM python3-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-GCE python3-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-HPC-Azure python3-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-HPC-BYOS-Azure python3-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-HPC-BYOS-EC2-HVM python3-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-HPC-BYOS-GCE python3-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-Manager-4-2-Proxy-BYOS-Azure python3-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-Manager-4-2-Proxy-BYOS-EC2-HVM python3-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-Manager-4-2-Proxy-BYOS-GCE python2-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure python3-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure python2-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM python3-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM python2-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE python3-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE python3-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-Micro-5-1-BYOS-Azure python3-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-Micro-5-1-BYOS-EC2-HVM python3-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-Micro-5-1-BYOS-GCE python3-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-Micro-5-2-BYOS-Azure python3-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-Micro-5-2-BYOS-EC2-HVM python3-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-Micro-5-2-BYOS-GCE python3-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-Micro-BYOS-GCE python2-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-SAP-Azure python3-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-SAP-Azure python3-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-SAP-Azure-LI-BYOS-Production python3-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production python3-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-SAP-BYOS-Azure python3-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-SAP-BYOS-EC2-HVM python3-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-SAP-BYOS-GCE python2-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-SAP-EC2-HVM python3-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-SAP-EC2-HVM python2-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-SAP-GCE python3-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-SAP-GCE python2-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-SAPCAL-Azure python3-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-SAPCAL-Azure python2-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-SAPCAL-EC2-HVM python3-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-SAPCAL-EC2-HVM python2-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-SAPCAL-GCE python3-setuptools-40.5.0-6.3.1 as a component of Image SLES15-SP3-SAPCAL-GCE python3-setuptools-40.5.0-6.3.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP1 python3-setuptools-40.5.0-6.3.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 python2-setuptools-40.5.0-6.3.1 as a component of SUSE Linux Enterprise Module for Python 2 15 SP1 python2-setuptools-40.5.0-6.3.1 as a component of SUSE Linux Enterprise Module for Python 2 15 SP2 The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py. CVE-2019-20916 Container bci/python:3:python3-setuptools-40.5.0-6.3.1 Container caasp/v4/389-ds:1.4.2:python3-setuptools-40.5.0-6.3.1 Container caasp/v4/k8s-sidecar:0.1.75:python3-setuptools-40.5.0-6.3.1 Container ses/6/cephcsi/cephcsi:latest:python3-setuptools-40.5.0-6.3.1 Container ses/6/rook/ceph:latest:python3-setuptools-40.5.0-6.3.1 Container ses/7.1/cephcsi/cephcsi:latest:python3-setuptools-40.5.0-6.3.1 Container ses/7.1/rook/ceph:latest:python3-setuptools-40.5.0-6.3.1 Container ses/7/cephcsi/cephcsi:latest:python3-setuptools-40.5.0-6.3.1 Container ses/7/rook/ceph:latest:python3-setuptools-40.5.0-6.3.1 Container suse/sles/15.3/virt-launcher:0.45.0:python3-setuptools-40.5.0-6.3.1 Container trento/trento-runner:latest:python3-setuptools-40.5.0-6.3.1 Image SLES15-SP3-BYOS-Azure:python3-setuptools-40.5.0-6.3.1 Image SLES15-SP3-BYOS-EC2-HVM:python3-setuptools-40.5.0-6.3.1 Image SLES15-SP3-BYOS-GCE:python3-setuptools-40.5.0-6.3.1 Image SLES15-SP3-CHOST-BYOS-Aliyun:python3-setuptools-40.5.0-6.3.1 Image SLES15-SP3-CHOST-BYOS-Azure:python3-setuptools-40.5.0-6.3.1 Image SLES15-SP3-CHOST-BYOS-EC2:python3-setuptools-40.5.0-6.3.1 Image SLES15-SP3-CHOST-BYOS-GCE:python3-setuptools-40.5.0-6.3.1 Image SLES15-SP3-CHOST-BYOS-SAP-CCloud:python3-setuptools-40.5.0-6.3.1 Image SLES15-SP3-EC2-ECS-HVM:python3-setuptools-40.5.0-6.3.1 Image SLES15-SP3-EC2-HVM:python2-setuptools-40.5.0-6.3.1 Image SLES15-SP3-EC2-HVM:python3-setuptools-40.5.0-6.3.1 Image SLES15-SP3-GCE:python3-setuptools-40.5.0-6.3.1 Image SLES15-SP3-HPC-Azure:python3-setuptools-40.5.0-6.3.1 Image SLES15-SP3-HPC-BYOS-Azure:python3-setuptools-40.5.0-6.3.1 Image SLES15-SP3-HPC-BYOS-EC2-HVM:python3-setuptools-40.5.0-6.3.1 Image SLES15-SP3-HPC-BYOS-GCE:python3-setuptools-40.5.0-6.3.1 Image SLES15-SP3-Manager-4-2-Proxy-BYOS-Azure:python3-setuptools-40.5.0-6.3.1 Image SLES15-SP3-Manager-4-2-Proxy-BYOS-EC2-HVM:python3-setuptools-40.5.0-6.3.1 Image SLES15-SP3-Manager-4-2-Proxy-BYOS-GCE:python3-setuptools-40.5.0-6.3.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure:python2-setuptools-40.5.0-6.3.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure:python3-setuptools-40.5.0-6.3.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM:python2-setuptools-40.5.0-6.3.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM:python3-setuptools-40.5.0-6.3.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE:python2-setuptools-40.5.0-6.3.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE:python3-setuptools-40.5.0-6.3.1 Image SLES15-SP3-Micro-5-1-BYOS-Azure:python3-setuptools-40.5.0-6.3.1 Image SLES15-SP3-Micro-5-1-BYOS-EC2-HVM:python3-setuptools-40.5.0-6.3.1 Image SLES15-SP3-Micro-5-1-BYOS-GCE:python3-setuptools-40.5.0-6.3.1 Image SLES15-SP3-Micro-5-2-BYOS-Azure:python3-setuptools-40.5.0-6.3.1 Image SLES15-SP3-Micro-5-2-BYOS-EC2-HVM:python3-setuptools-40.5.0-6.3.1 Image SLES15-SP3-Micro-5-2-BYOS-GCE:python3-setuptools-40.5.0-6.3.1 Image SLES15-SP3-Micro-BYOS-GCE:python3-setuptools-40.5.0-6.3.1 Image SLES15-SP3-SAP-Azure-LI-BYOS-Production:python3-setuptools-40.5.0-6.3.1 Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production:python3-setuptools-40.5.0-6.3.1 Image SLES15-SP3-SAP-Azure:python2-setuptools-40.5.0-6.3.1 Image SLES15-SP3-SAP-Azure:python3-setuptools-40.5.0-6.3.1 Image SLES15-SP3-SAP-BYOS-Azure:python3-setuptools-40.5.0-6.3.1 Image SLES15-SP3-SAP-BYOS-EC2-HVM:python3-setuptools-40.5.0-6.3.1 Image SLES15-SP3-SAP-BYOS-GCE:python3-setuptools-40.5.0-6.3.1 Image SLES15-SP3-SAP-EC2-HVM:python2-setuptools-40.5.0-6.3.1 Image SLES15-SP3-SAP-EC2-HVM:python3-setuptools-40.5.0-6.3.1 Image SLES15-SP3-SAP-GCE:python2-setuptools-40.5.0-6.3.1 Image SLES15-SP3-SAP-GCE:python3-setuptools-40.5.0-6.3.1 Image SLES15-SP3-SAPCAL-Azure:python2-setuptools-40.5.0-6.3.1 Image SLES15-SP3-SAPCAL-Azure:python3-setuptools-40.5.0-6.3.1 Image SLES15-SP3-SAPCAL-EC2-HVM:python2-setuptools-40.5.0-6.3.1 Image SLES15-SP3-SAPCAL-EC2-HVM:python3-setuptools-40.5.0-6.3.1 Image SLES15-SP3-SAPCAL-GCE:python2-setuptools-40.5.0-6.3.1 Image SLES15-SP3-SAPCAL-GCE:python3-setuptools-40.5.0-6.3.1 SUSE Linux Enterprise Module for Basesystem 15 SP1:python3-setuptools-40.5.0-6.3.1 SUSE Linux Enterprise Module for Basesystem 15 SP2:python3-setuptools-40.5.0-6.3.1 SUSE Linux Enterprise Module for Python 2 15 SP1:python2-setuptools-40.5.0-6.3.1 SUSE Linux Enterprise Module for Python 2 15 SP2:python2-setuptools-40.5.0-6.3.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20203566-1/ https://www.suse.com/security/cve/CVE-2019-20916.html CVE-2019-20916 https://bugzilla.suse.com/1176262 SUSE Bug 1176262