Moderate: python3 security update
Summary
ALSA-2022:1986: Moderate: python3 security update. Affects platform-python versions < 3.6.8-45.el8.alma. Fixed in 3.6.8-45.el8.alma. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Vulnerability Detail
The vulnerability in the python3 package is categorized as moderate. It includes the following security fixes:
-
CVE-2021-4189: The ftplib module in Python should not use the host from the PASV response, as it can lead to a potential security issue.
-
CVE-2021-3737: The urllib module in Python is susceptible to an infinite loop on a 100 Continue response, which can be exploited by an attacker.
These vulnerabilities can have various impacts on the affected systems, including potential security breaches and denial of service attacks.
How To Fix
Minimum fixed version
3.6.8-45.el8.alma
This is the first release that contains the fix.
sudo dnf update platform-pythonTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the python3 package in AlmaLinux 8 is affected by two moderate vulnerabilities. It is recommended to update the package to the fixed version to mitigate the potential risks. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for platform-python →
FAQ
Python is an interpreted, interactive, object-oriented programming language that supports various system calls and libraries.
CVE-2021-4189 can potentially lead to security issues if the ftplib module in Python uses the host from the PASV response.
CVE-2021-3737 can result in an infinite loop on a 100 Continue response in the urllib module of Python, which can be exploited by an attacker.
To update the python3 package, you can follow the standard package update procedures for the AlmaLinux 8 distribution.
You can find more information about these vulnerabilities, including their impact, CVSS scores, acknowledgments, and related details, on the respective CVE pages.
Related vulnerabilities
Recent vulnerabilities recorded for platform-python.
