Moderate: python3.11 security update
Summary
ALSA-2023:7024: Moderate: python3.11 security update. Affects python3.11 versions < 3.11.5-1.el8_9. Fixed in 3.11.5-1.el8_9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Vulnerability Detail
The python3.11 package is affected by two security vulnerabilities:
-
Directory traversal vulnerability (CVE-2007-4559): The tarfile module in Python allows an attacker to bypass intended directory restrictions via a crafted TAR archive that contains a symlink to an arbitrary location.
-
File path truncation vulnerability (CVE-2023-41105): Python is vulnerable to file path truncation, which can be exploited by an attacker to manipulate file paths and potentially access or overwrite sensitive files.
These vulnerabilities can lead to unauthorized access, information disclosure, or arbitrary code execution.
How To Fix
Minimum fixed version
3.11.5-1.el8_9
This is the first release that contains the fix.
sudo dnf update python3.11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
To mitigate the risks associated with these vulnerabilities, it is crucial to update the python3.11 package to version 3.11.5-1.el8_9 or later. This update includes security patches that address the directory traversal and file path truncation vulnerabilities. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for python3.11 →
FAQ
These vulnerabilities can allow an attacker to bypass directory restrictions, manipulate file paths, and potentially gain unauthorized access to sensitive files or execute arbitrary code.
There are no known exploits for these vulnerabilities at the time of this advisory.
There is no known workaround for these vulnerabilities. It is recommended to update the python3.11 package to the latest version.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and it will alert you in real-time if any open-source vulnerabilities are detected.
You can find more information about these vulnerabilities, including the impact, CVSS score, and acknowledgments, on the CVE pages: CVE-2007-4559 and CVE-2023-41105.
Related vulnerabilities
Recent vulnerabilities recorded for python3.11.
