Moderate Security Vulnerability in Python3 Packages: ALSA-2024:6975
Summary
ALSA-2024:6975: Moderate: python3 security update. Affects platform-python versions < 3.6.8-67.el8_10.alma.1. Fixed in 3.6.8-67.el8_10.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used interpreted, interactive, object-oriented programming language known for its simplicity and versatility. It supports various system calls, libraries, and windowing systems, making it a popular choice for developers. The affected packages include platform-python, platform-python-debug, platform-python-devel, python3-idle, python3-libs, python3-test, and python3-tkinter, all part of the AlmaLinux 8 ecosystem. These packages are essential for running Python applications and development environments.
Vulnerability Detail
The vulnerability stems from multiple security issues within Python 3, specifically affecting the handling of IP address ranges, email headers, and tarfile parsing. The identified CVEs include CVE-2024-4032, which involves incorrect handling of IPv4 and IPv6 private ranges, CVE-2024-6923, where the email module fails to properly quote newlines in headers, leading to potential header injection, and CVE-2024-6232, which allows for Regular Expression Denial of Service (ReDoS) through excessive backtracking while parsing tarfile header values. These vulnerabilities could lead to unauthorized access, service disruptions, or exploitation of the affected systems.
How To Fix
Minimum fixed version
3.6.8-67.el8_10.alma.1
This is the first release that contains the fix.
sudo dnf update platform-pythonTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the affected services or implement input validation to mitigate the risks associated with the vulnerabilities until the packages are updated. However, the best course of action is to apply the updates as soon as possible.
Conclusion
The security update for Python3 packages addresses critical vulnerabilities that could compromise system integrity and availability. Users are strongly advised to update their packages promptly to mitigate risks associated with these vulnerabilities.
See every vulnerability recorded for platform-python →
FAQ
The main vulnerabilities include incorrect handling of IP address ranges, improper quoting of newlines in email headers, and potential ReDoS through tarfile parsing.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerabilities could lead to unauthorized access, service disruptions, and exploitation of systems running the affected Python packages.
If immediate updates are not possible, consider restricting access to affected services and implementing input validation as a temporary workaround.
More information can be found on the CVE pages for CVE-2024-4032, CVE-2024-6923, and CVE-2024-6232.
Related vulnerabilities
Recent vulnerabilities recorded for platform-python.
