CVE-2020-27619
First published: Mon Oct 05 2020(Updated: )
An unspecified error with CJK codec tests call eval() on content retrieved throug HTTP in multibytecodec_support.py in Python has an unknown impact and attack vector.
Credit: cve@mitre.org cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/python3 | <0:3.6.8-37.el8 | 0:3.6.8-37.el8 |
| redhat/python27-babel | <0:0.9.6-10.el7 | 0:0.9.6-10.el7 |
| redhat/python27-python | <0:2.7.18-3.el7 | 0:2.7.18-3.el7 |
| redhat/python27-python-jinja2 | <0:2.6-16.el7 | 0:2.6-16.el7 |
| redhat/python27-python-pygments | <0:1.5-5.el7 | 0:1.5-5.el7 |
| redhat/rh-python38-babel | <0:2.7.0-12.el7 | 0:2.7.0-12.el7 |
| redhat/rh-python38-python | <0:3.8.11-2.el7 | 0:3.8.11-2.el7 |
| redhat/rh-python38-python-cryptography | <0:2.8-5.el7 | 0:2.8-5.el7 |
| redhat/rh-python38-python-jinja2 | <0:2.10.3-6.el7 | 0:2.10.3-6.el7 |
| redhat/rh-python38-python-lxml | <0:4.4.1-7.el7 | 0:4.4.1-7.el7 |
| redhat/rh-python38-python-pip | <0:19.3.1-2.el7 | 0:19.3.1-2.el7 |
| redhat/rh-python38-python-urllib3 | <0:1.25.7-7.el7 | 0:1.25.7-7.el7 |
| Python Python | >=3.0.0<3.6.13 | |
| Python Python | >=3.7.0<3.7.10 | |
| Python Python | >=3.8.0<3.8.7 | |
| Python Python | >=3.9.0<3.9.1 | |
| Fedoraproject Fedora | =33 | |
| Fedoraproject Fedora | =34 | |
| Oracle Communications Cloud Native Core Network Function Cloud Native Environment | =22.2.0 | |
| redhat/python | <3.6.13 | 3.6.13 |
| redhat/python | <3.7.10 | 3.7.10 |
| redhat/python | <3.8.7 | 3.8.7 |
| redhat/python | <3.9.1 | 3.9.1 |
| debian/pypy3 | 7.3.5+dfsg-2+deb11u2 7.3.5+dfsg-2+deb11u4 7.3.11+dfsg-2+deb12u2 7.3.17+dfsg-3 | |
| debian/python2.7 | <=2.7.18-8+deb11u1 | |
| debian/python3.9 | 3.9.2-1 3.9.2-1+deb11u2 |
Remedy
In versions of Python shipped with Red Hat Enterprise Linux and Red Hat Software Collections, the flaw can be mitigated by not running the python tests with network resources enabled. By default, the tests are not run with network resources enabled. Ensure that `-u network` or `-uall` are not passed as options to `python -m test`. For more information on how these commands work, see [1]. 1. https://docs.python.org/3/library/test.html
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2020-27619 https://nvd.nist.gov/vuln/detail/CVE-2020-27619
- https://bugzilla.redhat.com/show_bug.cgi?id=1889886
- https://access.redhat.com/errata/RHSA-2021:1633
- https://access.redhat.com/errata/RHSA-2021:4151
- https://access.redhat.com/errata/RHSA-2021:4162
- https://access.redhat.com/errata/RHSA-2021:3252
- https://access.redhat.com/errata/RHSA-2021:3254
- https://access.redhat.com/security/cve/cve-2020-27619
- https://bugs.python.org/issue41944
- https://github.com/python/cpython/commit/2ef5caa58febc8968e670e39e3d37cf8eef3cab8
- https://github.com/python/cpython/commit/43e523103886af66d6c27cd72431b5d9d14cd2a9
- https://github.com/python/cpython/commit/6c6c256df3636ff6f6136820afaefa5a10a3ac33
- https://github.com/python/cpython/commit/b664a1df4ee71d3760ab937653b10997081b1794
- https://github.com/python/cpython/commit/e912e945f2960029d039d3390ea08835ad39374b
- https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E
- https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E
- https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
- https://security.netapp.com/advisory/ntap-20201123-0004/
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1889886#c0
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1890227
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1890221
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1890222
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1890223
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1890224
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1890225
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1890226
- http://www.pythontest.net/
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1889886#c7
- https://docs.python.org/3/library/test.html
- https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
- https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
- https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
- https://security.gentoo.org/glsa/202402-04
- https://launchpad.net/bugs/cve/CVE-2020-27619
- https://exchange.xforce.ibmcloud.com/vulnerabilities/190408
- https://www.ibm.com/support/pages/node/6491661 (Advisory)
- https://python-security.readthedocs.io/vuln/cjk-codec-download-eval.html
- https://github.com/python/cpython/commit/a8bf44d04915f7366d9f8dfbf84822ac37a4bab3
- https://security-tracker.debian.org/tracker/CVE-2020-27619
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27619
- https://nvd.nist.gov/vuln/detail/CVE-2020-27619
- https://ubuntu.com/security/CVE-2020-27619
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is the severity of CVE-2020-27619?
The severity of CVE-2020-27619 is critical with a CVSS score of 9.8.
How does CVE-2020-27619 impact Python?
CVE-2020-27619 is an unspecified error with CJK codec tests in Python that calls eval() on content retrieved through HTTP, with an unknown impact and attack vector.
Which versions of Python are affected by CVE-2020-27619?
Python versions 3.6.13, 3.7.10, 3.8.7, and 3.9.1 are affected by CVE-2020-27619.
What is the recommended remedy for CVE-2020-27619 in Python?
To fix CVE-2020-27619 in Python, update to the following versions or later: 3.6.14, 3.7.11, 3.8.8, or 3.9.2.
Where can I find more information about CVE-2020-27619?
You can find more information about CVE-2020-27619 at the following references: [Link 1](https://bugs.python.org/issue41944), [Link 2](https://github.com/python/cpython/commit/2ef5caa58febc8968e670e39e3d37cf8eef3cab8), [Link 3](https://github.com/python/cpython/commit/b664a1df4ee71d3760ab937653b10997081b1794).
- collector/redhat-cve
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2020-27619
- agent/software-canonical-lookup
- agent/weakness
- agent/severity
- collector/nvd-api
- source/NVD
- agent/author
- collector/launchpad-cve
- source/Launchpad
- agent/remedy
- collector/ibm-support
- source/IBM
- collector/mitre-cve
- source/MITRE
- collector/usn-cve
- source/Ubuntu
- agent/references
- agent/tags
- agent/description
- agent/event
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- collector/nvd-cve
- agent/last-modified-date
- agent/trending
- package-manager/redhat
- vendor/python
- canonical/python python
- version/python python/3.0.0
- version/python python/3.7.0
- version/python python/3.8.0
- version/python python/3.9.0
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/33
- version/fedoraproject fedora/34
- vendor/oracle
- canonical/oracle communications cloud native core network function cloud native environment
- version/oracle communications cloud native core network function cloud native environment/22.2.0
- package-manager/debian