The following packages have been upgraded to a later upstream version: rh-python36-python (3.6.9). (BZ#1709344) Security Fix(es): * python: DOS via regular expression backtracking in difflib.IS_LINE_JUNK method in difflib (CVE-2018-1061) * python: Missing salt initialization in _elementtree.c module (CVE-2018-14647) * python: Cookie domain check returns incorrect results (CVE-2018-20852) * python: NULL pointer dereference using a specially crafted X509 certificate (CVE-2019-5010) * python: CRLF injection via the query part of the url passed to urlopen() (CVE-2019-9740) * python: CRLF injection via the path part of the url passed to urlopen() (CVE-2019-9947) * python: email.utils.parseaddr wrongly parses email addresses (CVE-2019-16056) * python: DOS via regular expression catastrophic backtracking in apop() method in pop3lib (CVE-2018-1060) * python: Integer overflow in Modules/_pickle.c allows for memory exhaustion if serializing gigabytes of data (CVE-2018-20406) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * urlsplit doesn't accept a NFKD hostname with a port number (BZ#1709340) * rh-python36 cannot unpickle datetime.date objects (BZ#1749103)