moderate: perl-HTTP-Tiny/python-requests security update
moderate
An update for perl-HTTP-Tiny/python-requests is now available for NewStart CGSL MAIN 6.02.
NewStart Security has rated this update as having a security impact of moderate. A Common Vunlnerability Scoring System(CVSS)base score, which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.
perl-HTTP-Tiny:
python-requests:
Security Fix(es):
perl-HTTP-Tiny: It was found that perl can load modules from the current directory if not found in the module directories, via the @INC path. A local, authenticated attacker could create a specially crafted module in a writable directory and trick a user into running a perl program from that directory; if the module is not found in previous @INC paths, it will load and execute the attacker's module.(CVE-2016-1238)
perl-HTTP-Tiny: An Insecure Default Initialization of Resource flaw was found in HTTP::Tiny, where TLS certificates were not verified by default. This flaw can lead to loss of confidentiality, integrity, and availability.(CVE-2023-31486)
perl-HTTP-Tiny: bugfix
python-requests: A flaw was found in the way python-requests set the domain cookie parameter for certain HTTP responses. A remote attacker could use this flaw to modify a cookie to be sent to an arbitrary URL.(CVE-2015-2296)
python-requests: bugfix
Solution:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
http://security.gd-linux.com/how_to_apply_patch.html
Remember the build tag is 6.02.F2B12.