python-2.7.5-92.0.1.el7.AXS7

Python is an interpreted, interactive, object-oriented programming language,
which includes modules, classes, exceptions, very high level dynamic data types
and dynamic typing. Python supports interfaces to many system calls and
libraries, as well as to various windowing systems.

Security Fix(es):

* python: CRLF injection via HTTP request method in httplib/http.client
(CVE-2020-26116)
* python-urllib3: CRLF injection via HTTP request method (CVE-2020-26137)
* python: Stack-based buffer overflow in PyCArg_repr in _ctypes/callproc.c
(CVE-2021-3177)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.

CVE-2020-26116
http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before
3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the
HTTP request method, as demonstrated by inserting CR and LF control characters
in the first argument of HTTPConnection.request.
CVE-2020-26137
urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP
request method, as demonstrated by inserting CR and LF control characters in the
first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.
CVE-2021-3177
Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in
_ctypes/callproc.c, which may lead to remote code execution in certain Python
applications that accept floating-point numbers as untrusted input, as
demonstrated by a 1e300 argument to c_double.from_param. This occurs because
sprintf is used unsafely.