Moderate Security Update for Python3: Addressing Path Quoting and IPv6 Validation Vulnerabilities
Summary
ALSA-2024:10779: Moderate: python3:3.6.8 security update. Affects platform-python versions < 3.6.8-69.el8_10.alma.1. Fixed in 3.6.8-69.el8_10.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, and dynamic data types. It is known for its simplicity and versatility, making it a popular choice for developers. However, recent vulnerabilities have been identified in Python 3.6.8, specifically affecting the platform-python packages in AlmaLinux 8, which could lead to security risks if not addressed promptly.
Vulnerability Detail
The vulnerabilities identified in Python 3.6.8 include improper quoting of paths in virtual environment activation scripts (CVE-2024-9287) and inadequate validation of IPv6 and IPvFuture addresses (CVE-2024-11168). These issues can potentially allow attackers to exploit the system by manipulating environment variables or sending malformed network requests, leading to unauthorized access or denial of service.
How To Fix
Minimum fixed version
3.6.8-69.el8_10.alma.1
This is the first release that contains the fix.
sudo dnf update platform-pythonTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually quote paths in their virtual environment activation scripts to mitigate the risk of path manipulation until the update is applied. Additionally, ensure that any IPv6 addresses are validated before use in your applications.
Conclusion
The vulnerabilities in Python 3.6.8 pose significant security risks that must be addressed promptly. By updating to the patched version and implementing the recommended workarounds, users can protect their systems from potential exploitation. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for open-source vulnerabilities.
See every vulnerability recorded for platform-python →
FAQ
The vulnerabilities can lead to unauthorized access and potential exploitation of the system, affecting the integrity and availability of applications relying on Python.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
The vulnerabilities are associated with CVE-2024-9287 and CVE-2024-11168, which detail the issues related to path quoting and IPv6 validation.
It is not recommended to continue using Python 3.6.8 due to the identified vulnerabilities. It is best to update to the patched version as soon as possible.
If an immediate update is not possible, implement the suggested workarounds and monitor your applications closely for any unusual activity.
Related vulnerabilities
Recent vulnerabilities recorded for platform-python.
