<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for python39</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>SUSE-SU-2021:2940-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2021-09-03T07:22:28Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2021-09-03T07:22:28Z</InitialReleaseDate>
    <CurrentReleaseDate>2021-09-03T07:22:28Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for python39</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">This update for python39 fixes the following issues:

- CVE-2021-29921: Fixed improper input validation of octal string IP addresses (bsc#1185706).
- Use versioned python-Sphinx to avoid dependency on other version of Python (bsc#1183858).
- Stop providing 'python' symbol (bsc#1185588), which means python2 currently.
</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
    <Note Title="Patchnames" Type="Details" Ordinal="4" xml:lang="en">Container bci/python:3-2021-2940,SUSE-2021-2940,SUSE-SLE-Module-Basesystem-15-SP3-2021-2940,SUSE-SLE-Module-Development-Tools-15-SP3-2021-2940</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/update/announcement/2021/suse-su-20212940-1/</URL>
      <Description>Link for SUSE-SU-2021:2940-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://lists.suse.com/pipermail/sle-security-updates/2021-September/009402.html</URL>
      <Description>E-Mail link for SUSE-SU-2021:2940-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1183858</URL>
      <Description>SUSE Bug 1183858</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1185588</URL>
      <Description>SUSE Bug 1185588</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1185706</URL>
      <Description>SUSE Bug 1185706</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2021-29921/</URL>
      <Description>SUSE CVE CVE-2021-29921 page</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="Container bci/python:3">
      <Branch Type="Product Name" Name="Container bci/python:3">
        <FullProductName ProductID="Container bci/python:3">Container bci/python:3</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Module for Basesystem 15 SP3">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Module for Basesystem 15 SP3">
        <FullProductName ProductID="SUSE Linux Enterprise Module for Basesystem 15 SP3" CPE="cpe:/o:suse:sle-module-basesystem:15:sp3">SUSE Linux Enterprise Module for Basesystem 15 SP3</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Module for Development Tools 15 SP3">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Module for Development Tools 15 SP3">
        <FullProductName ProductID="SUSE Linux Enterprise Module for Development Tools 15 SP3" CPE="cpe:/o:suse:sle-module-development-tools:15:sp3">SUSE Linux Enterprise Module for Development Tools 15 SP3</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="libpython3_9-1_0-3.9.6-4.3.3">
      <FullProductName ProductID="libpython3_9-1_0-3.9.6-4.3.3">libpython3_9-1_0-3.9.6-4.3.3</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="python39-3.9.6-4.3.4">
      <FullProductName ProductID="python39-3.9.6-4.3.4">python39-3.9.6-4.3.4</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="python39-base-3.9.6-4.3.3">
      <FullProductName ProductID="python39-base-3.9.6-4.3.3">python39-base-3.9.6-4.3.3</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="python39-devel-3.9.6-4.3.3">
      <FullProductName ProductID="python39-devel-3.9.6-4.3.3">python39-devel-3.9.6-4.3.3</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libpython3_9-1_0-32bit-3.9.6-4.3.3">
      <FullProductName ProductID="libpython3_9-1_0-32bit-3.9.6-4.3.3">libpython3_9-1_0-32bit-3.9.6-4.3.3</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libpython3_9-1_0-64bit-3.9.6-4.3.3">
      <FullProductName ProductID="libpython3_9-1_0-64bit-3.9.6-4.3.3">libpython3_9-1_0-64bit-3.9.6-4.3.3</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="python39-32bit-3.9.6-4.3.4">
      <FullProductName ProductID="python39-32bit-3.9.6-4.3.4">python39-32bit-3.9.6-4.3.4</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="python39-64bit-3.9.6-4.3.4">
      <FullProductName ProductID="python39-64bit-3.9.6-4.3.4">python39-64bit-3.9.6-4.3.4</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="python39-base-32bit-3.9.6-4.3.3">
      <FullProductName ProductID="python39-base-32bit-3.9.6-4.3.3">python39-base-32bit-3.9.6-4.3.3</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="python39-base-64bit-3.9.6-4.3.3">
      <FullProductName ProductID="python39-base-64bit-3.9.6-4.3.3">python39-base-64bit-3.9.6-4.3.3</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="python39-curses-3.9.6-4.3.4">
      <FullProductName ProductID="python39-curses-3.9.6-4.3.4">python39-curses-3.9.6-4.3.4</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="python39-dbm-3.9.6-4.3.4">
      <FullProductName ProductID="python39-dbm-3.9.6-4.3.4">python39-dbm-3.9.6-4.3.4</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="python39-doc-3.9.6-4.3.1">
      <FullProductName ProductID="python39-doc-3.9.6-4.3.1">python39-doc-3.9.6-4.3.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="python39-doc-devhelp-3.9.6-4.3.1">
      <FullProductName ProductID="python39-doc-devhelp-3.9.6-4.3.1">python39-doc-devhelp-3.9.6-4.3.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="python39-idle-3.9.6-4.3.4">
      <FullProductName ProductID="python39-idle-3.9.6-4.3.4">python39-idle-3.9.6-4.3.4</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="python39-testsuite-3.9.6-4.3.3">
      <FullProductName ProductID="python39-testsuite-3.9.6-4.3.3">python39-testsuite-3.9.6-4.3.3</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="python39-tk-3.9.6-4.3.4">
      <FullProductName ProductID="python39-tk-3.9.6-4.3.4">python39-tk-3.9.6-4.3.4</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="python39-tools-3.9.6-4.3.3">
      <FullProductName ProductID="python39-tools-3.9.6-4.3.3">python39-tools-3.9.6-4.3.3</FullProductName>
    </Branch>
    <Relationship ProductReference="libpython3_9-1_0-3.9.6-4.3.3" RelationType="Default Component Of" RelatesToProductReference="Container bci/python:3">
      <FullProductName ProductID="Container bci/python:3:libpython3_9-1_0-3.9.6-4.3.3">libpython3_9-1_0-3.9.6-4.3.3 as a component of Container bci/python:3</FullProductName>
    </Relationship>
    <Relationship ProductReference="python39-3.9.6-4.3.4" RelationType="Default Component Of" RelatesToProductReference="Container bci/python:3">
      <FullProductName ProductID="Container bci/python:3:python39-3.9.6-4.3.4">python39-3.9.6-4.3.4 as a component of Container bci/python:3</FullProductName>
    </Relationship>
    <Relationship ProductReference="python39-base-3.9.6-4.3.3" RelationType="Default Component Of" RelatesToProductReference="Container bci/python:3">
      <FullProductName ProductID="Container bci/python:3:python39-base-3.9.6-4.3.3">python39-base-3.9.6-4.3.3 as a component of Container bci/python:3</FullProductName>
    </Relationship>
    <Relationship ProductReference="python39-devel-3.9.6-4.3.3" RelationType="Default Component Of" RelatesToProductReference="Container bci/python:3">
      <FullProductName ProductID="Container bci/python:3:python39-devel-3.9.6-4.3.3">python39-devel-3.9.6-4.3.3 as a component of Container bci/python:3</FullProductName>
    </Relationship>
    <Relationship ProductReference="libpython3_9-1_0-3.9.6-4.3.3" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Basesystem 15 SP3">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Basesystem 15 SP3:libpython3_9-1_0-3.9.6-4.3.3">libpython3_9-1_0-3.9.6-4.3.3 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="python39-3.9.6-4.3.4" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Basesystem 15 SP3">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Basesystem 15 SP3:python39-3.9.6-4.3.4">python39-3.9.6-4.3.4 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="python39-base-3.9.6-4.3.3" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Basesystem 15 SP3">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Basesystem 15 SP3:python39-base-3.9.6-4.3.3">python39-base-3.9.6-4.3.3 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="python39-curses-3.9.6-4.3.4" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Basesystem 15 SP3">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Basesystem 15 SP3:python39-curses-3.9.6-4.3.4">python39-curses-3.9.6-4.3.4 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="python39-dbm-3.9.6-4.3.4" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Basesystem 15 SP3">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Basesystem 15 SP3:python39-dbm-3.9.6-4.3.4">python39-dbm-3.9.6-4.3.4 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="python39-devel-3.9.6-4.3.3" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Basesystem 15 SP3">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Basesystem 15 SP3:python39-devel-3.9.6-4.3.3">python39-devel-3.9.6-4.3.3 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="python39-idle-3.9.6-4.3.4" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Basesystem 15 SP3">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Basesystem 15 SP3:python39-idle-3.9.6-4.3.4">python39-idle-3.9.6-4.3.4 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="python39-tk-3.9.6-4.3.4" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Basesystem 15 SP3">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Basesystem 15 SP3:python39-tk-3.9.6-4.3.4">python39-tk-3.9.6-4.3.4 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="python39-tools-3.9.6-4.3.3" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Development Tools 15 SP3">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Development Tools 15 SP3:python39-tools-3.9.6-4.3.3">python39-tools-3.9.6-4.3.3 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP3</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses.</Note>
    </Notes>
    <CVE>CVE-2021-29921</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>Container bci/python:3:libpython3_9-1_0-3.9.6-4.3.3</ProductID>
        <ProductID>Container bci/python:3:python39-3.9.6-4.3.4</ProductID>
        <ProductID>Container bci/python:3:python39-base-3.9.6-4.3.3</ProductID>
        <ProductID>Container bci/python:3:python39-devel-3.9.6-4.3.3</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15 SP3:libpython3_9-1_0-3.9.6-4.3.3</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15 SP3:python39-3.9.6-4.3.4</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15 SP3:python39-base-3.9.6-4.3.3</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15 SP3:python39-curses-3.9.6-4.3.4</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15 SP3:python39-dbm-3.9.6-4.3.4</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15 SP3:python39-devel-3.9.6-4.3.3</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15 SP3:python39-idle-3.9.6-4.3.4</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15 SP3:python39-tk-3.9.6-4.3.4</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Development Tools 15 SP3:python39-tools-3.9.6-4.3.3</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>7.5</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>8.6</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2021/suse-su-20212940-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2021-29921.html</URL>
        <Description>CVE-2021-29921</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1185706</URL>
        <Description>SUSE Bug 1185706</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
