Moderate: python3 security update
Summary
ALSA-2023:0833: Moderate: python3 security update. Affects platform-python versions < 3.6.8-48.el8_7.1.alma. Fixed in 3.6.8-48.el8_7.1.alma. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Vulnerability Detail
This vulnerability allows an attacker to cause a denial of service (DoS) or potentially disclose sensitive information. The specific vulnerabilities addressed in this update are:
- CVE-2020-10735: The int() type in PyLong_FromString() does not limit the amount of digits when converting text to an integer, leading to a DoS.
- CVE-2021-28861: An open redirection vulnerability in lib/http/server.py may lead to information disclosure.
- CVE-2022-45061: The IDNA decoder in Python is inefficient and can be abused to cause a CPU DoS.
How To Fix
Minimum fixed version
3.6.8-48.el8_7.1.alma
This is the first release that contains the fix.
sudo dnf update platform-pythonTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
It is recommended to update the affected Python packages to the latest version to mitigate these vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform-python →
FAQ
These vulnerabilities can lead to a denial of service (DoS) attack or potential information disclosure.
There are no known exploits for these vulnerabilities at the time of this advisory.
Yes, these vulnerabilities can be exploited remotely.
No, there is no known workaround for these vulnerabilities.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by these vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for platform-python.
