python, tkinter security update

CentOS Errata and Security Advisory CESA-2018:2123

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• A flaw was found in the way the DES/3DES cipher was used as part of the TLS/SSL protocol. A man-in-the-middle attacker could use this flaw to recover some plaintext data by capturing large amounts of encrypted traffic between TLS/SSL server and client if the communication used a DES/3DES based ciphersuite. (CVE-2016-2183)

Note: This update modifies the Python ssl module to disable 3DES cipher suites by default.

Red Hat would like to thank OpenVPN for reporting this issue. Upstream acknowledges Karthikeyan Bhargavan (Inria) and Gaëtan Leurent (Inria) as the original reporters.

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2018-July/085126.html

Affected packages:
python
python-debug
python-devel
python-libs
python-test
python-tools
tkinter

Upstream details at:
https://access.redhat.com/errata/RHSA-2018:2123