Important: python3 security update
Summary
ALSA-2024:3347: Important: python3 security update. Affects platform-python versions < 3.6.8-62.el8_10.alma.1. Fixed in 3.6.8-62.el8_10.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Vulnerability Detail
The python3 package is affected by two security vulnerabilities:
-
Path traversal on tempfile.TemporaryDirectory (CVE-2023-6597): This vulnerability allows an attacker to perform a path traversal attack when using the tempfile.TemporaryDirectory class. By exploiting this vulnerability, an attacker can access files outside of the intended directory.
-
Zip-bombs leading to denial of service (CVE-2024-0450): The zipfile module in Python is vulnerable to zip-bombs, which are maliciously crafted zip files that can cause a denial of service by consuming excessive CPU and memory resources when extracted.
How To Fix
Minimum fixed version
3.6.8-62.el8_10.alma.1
This is the first release that contains the fix.
sudo dnf update platform-pythonTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
To ensure the security of your system, it is crucial to update the python3 package to version 3.6.8-62.el8_10.alma.1 or later. This update includes fixes for two important security vulnerabilities. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for platform-python →
FAQ
The path traversal vulnerability allows an attacker to access files outside of the intended directory. This can lead to unauthorized access to sensitive information or the execution of arbitrary code.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by these vulnerabilities. Simply upload your package-lock.json file and the playground will analyze it for any open-source vulnerabilities.
At the moment, there are no known workarounds for these vulnerabilities. It is recommended to update the python3 package to the latest version.
The CVSS scores for these vulnerabilities have not been provided in the vulnerability details. It is advisable to refer to the CVE pages for more information.
The discoverer of these vulnerabilities has not been mentioned in the vulnerability details. It is recommended to refer to the CVE pages for acknowledgments and additional information.
Related vulnerabilities
Recent vulnerabilities recorded for platform-python.
