CVE-2020-27619

In Python3's Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP.

As of Red Hat Quay 3.4 the python runtime will be consumed from RHEL. Currently releases up to 3.3 won't get fixes for this moderate issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

In versions of Python shipped with Red Hat Enterprise Linux and Red Hat Software Collections, the flaw can be mitigated by not running the python tests with network resources enabled. By default, the tests are not run with network resources enabled. Ensure that -u network or -uall are not passed as options to python -m test. For more information on how these commands work, see [1].

1. https://docs.python.org/3/library/test.html