Oval Definition:oval:org.opensuse.security:def:68741
Revision Date:2020-12-09Version:1
Title:Security update for python-pip, python-scripttest (Moderate)
Description:

This update for python-pip, python-scripttest fixes the following issues:

- Update in SLE-15 (bsc#1175297, jsc#ECO-3035, jsc#PM-2318)

python-pip was updated to 20.0.2:

Fix a regression in generation of compatibility tags * Rename an internal module, to avoid ImportErrors due to improper uninstallation * Switch to a dedicated CLI tool for vendoring dependencies. * Remove wheel tag calculation from pip and use packaging.tags. This should provide more tags ordered better than in prior releases. * Deprecate setup.py-based builds that do not generate an .egg-info directory. * The pip>=20 wheel cache is not retro-compatible with previous versions. Until pip 21.0, pip will continue to take advantage of existing legacy cache entries. * Deprecate undocumented --skip-requirements-regex option. * Deprecate passing install-location-related options via --install-option. * Use literal 'abi3' for wheel tag on CPython 3.x, to align with PEP 384 which only defines it for this platform. * Remove interpreter-specific major version tag e.g. cp3-none-any from consideration. This behavior was not documented strictly, and this tag in particular is not useful. Anyone with a use case can create an issue with pypa/packaging. * Wheel processing no longer permits wheels containing more than one top-level .dist-info directory. * Support for the git+git@ form of VCS requirement is being deprecated and will be removed in pip 21.0. Switch to git+https:// or git+ssh://. git+git:// also works but its use is discouraged as it is insecure. * Default to doing a user install (as if --user was passed) when the main site-packages directory is not writeable and user site-packages are enabled. * Warn if a path in PATH starts with tilde during pip install. * Cache wheels built from Git requirements that are considered immutable, because they point to a commit hash. * Add option --no-python-version-warning to silence warnings related to deprecation of Python versions. * Cache wheels that pip wheel built locally, matching what pip install does. This particularly helps performance in workflows where pip wheel is used for building before installing. Users desiring the original behavior can use pip wheel --no-cache-dir * Display CA information in pip debug. * Show only the filename (instead of full URL), when downloading from PyPI. * Suggest a more robust command to upgrade pip itself to avoid confusion when the current pip command is not available as pip. * Define all old pip console script entrypoints to prevent import issues in stale wrapper scripts. * The build step of pip wheel now builds all wheels to a cache first, then copies them to the wheel directory all at once. Before, it built them to a temporary directory and moved them to the wheel directory one by one. * Expand ~ prefix to user directory in path options, configs, and environment variables. Values that may be either URL or path are not currently supported, to avoid ambiguity:

--find-links --constraint, -c --requirement, -r --editable, -e

Correctly handle system site-packages, in virtual environments created with venv (PEP 405). * Fix case sensitive comparison of pip freeze when used with -r option. * Enforce PEP 508 requirement format in pyproject.toml build-system.requires. * Make ensure_dir() also ignore ENOTEMPTY as seen on Windows. * Fix building packages which specify backend-path in pyproject.toml. * Do not attempt to run setup.py clean after a pep517 build error, since a setup.py may not exist in that case. * Fix passwords being visible in the index-url in 'Downloading ' message. * Change method from shutil.remove to shutil.rmtree in noxfile.py. * Skip running tests which require subversion, when svn isn't installed * Fix not sending client certificates when using --trusted-host. * Make sure pip wheel never outputs pure python wheels with a python implementation tag. Better fix/workaround for #3025 by using a per-implementation wheel cache instead of caching pure python wheels with an implementation tag in their name. * Include subdirectory URL fragments in cache keys. * Fix typo in warning message when any of --build-option, --global-option and --install-option is used in requirements.txt * Fix the logging of cached HTTP response shown as downloading. * Effectively disable the wheel cache when it is not writable, as is the case with the http cache. * Correctly handle relative cache directory provided via --cache-dir.
Family:unixClass:patch
Status:Reference(s):1051510
1071995
1079730
1088047
1094555
1098403
1098633
1106383
1106751
1109137
1111025
1114279
1117665
1119532
1119991
1120423
1124167
1127155
1128432
1128902
1128910
1131645
1132154
1132390
1133401
1133738
1134303
1134395
1135296
1135556
1135642
1136157
1136598
1136922
1136935
1137103
1137194
1137429
1137625
1137728
1137884
1137995
1137996
1137998
1137999
1138000
1138002
1138003
1138005
1138006
1138007
1138008
1138009
1138010
1138011
1138012
1138013
1138014
1138015
1138016
1138017
1138018
1138019
1138291
1138293
1138374
1138375
1138589
1138719
1139771
1139782
1139865
1140133
1140328
1140405
1140424
1140428
1140575
1140577
1140637
1140658
1140715
1140719
1140726
1140727
1140728
1140814
1143794
1144087
1145379
1145427
1145436
1145774
1146873
1149811
1152506
1175297
1176262
CVE-2018-12207
CVE-2018-16871
CVE-2018-20126
CVE-2018-20836
CVE-2019-10126
CVE-2019-10638
CVE-2019-10639
CVE-2019-11135
CVE-2019-11599
CVE-2019-12068
CVE-2019-12380
CVE-2019-12456
CVE-2019-12614
CVE-2019-12818
CVE-2019-12819
CVE-2019-14378
CVE-2019-15890
CVE-2019-20916
SUSE-SU-2019:1829-1
SUSE-SU-2019:2955-1
SUSE-SU-2020:3737-1
Platform(s):SUSE Linux Enterprise Desktop 15 SP2
SUSE Linux Enterprise High Performance Computing 15 SP2
SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP1
SUSE Linux Enterprise Module for Python 2 15 SP2
SUSE Linux Enterprise Server 15 SP2
SUSE Linux Enterprise Server for SAP Applications 15 SP2
SUSE Linux Enterprise Storage 7
SUSE Manager Proxy 4.1
SUSE Manager Server 4.1
Product(s):
Definition Synopsis
  • SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP1 is installed
  • AND Package Information
  • cluster-md-kmp-azure-4.12.14-5.33 is installed
  • OR dlm-kmp-azure-4.12.14-5.33 is installed
  • OR gfs2-kmp-azure-4.12.14-5.33 is installed
  • OR kernel-azure-4.12.14-5.33 is installed
  • OR kernel-azure-base-4.12.14-5.33 is installed
  • OR kernel-azure-devel-4.12.14-5.33 is installed
  • OR kernel-azure-extra-4.12.14-5.33 is installed
  • OR kernel-azure-livepatch-4.12.14-5.33 is installed
  • OR kernel-devel-azure-4.12.14-5.33 is installed
  • OR kernel-source-azure-4.12.14-5.33 is installed
  • OR kernel-syms-azure-4.12.14-5.33 is installed
  • OR kselftests-kmp-azure-4.12.14-5.33 is installed
  • OR ocfs2-kmp-azure-4.12.14-5.33 is installed
  • OR reiserfs-kmp-azure-4.12.14-5.33 is installed
  • Definition Synopsis
  • SUSE Linux Enterprise Module for Python 2 15 SP2 is installed
  • AND python2-pip-20.0.2-6.12.1 is installed
  • BACK