Moderate: python3 security update
Summary
ALSA-2022:6457: Moderate: python3 security update. Affects platform-python versions < 3.6.8-47.el8_6.alma. Fixed in 3.6.8-47.el8_6.alma. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Vulnerability Detail
The vulnerability in Python is twofold:
-
CVE-2015-20107: The
findmatch()function in themailcapmodule does not properly sanitize the second argument, which could lead to arbitrary command execution. -
CVE-2022-0391: The
urllib.parsemodule does not properly sanitize URLs containing ASCII newline and tabs, which could allow an attacker to bypass security restrictions or conduct various attacks.
How To Fix
Minimum fixed version
3.6.8-47.el8_6.alma
This is the first release that contains the fix.
sudo dnf update platform-pythonTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, it is important to update the affected Python packages to the fixed versions to mitigate the security risks associated with these vulnerabilities. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for platform-python →
FAQ
The impact of CVE-2015-20107 is that an attacker could execute arbitrary commands by providing a specially crafted argument to the findmatch() function in the mailcap module.
The impact of CVE-2022-0391 is that an attacker could bypass security restrictions or conduct various attacks by providing URLs containing ASCII newline and tabs to the urllib.parse module.
There are no known exploits for these vulnerabilities at the moment.
There is no specific workaround available for these vulnerabilities. It is recommended to update the affected Python packages to the fixed versions.
You can find more information about these vulnerabilities in the CVE pages listed in the References section of the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for platform-python.
