Security Update for Python 3.12: Addressing Multiple Vulnerabilities
Summary
ALSA-2024:6961: Moderate: python3.12 security update. Affects python3.12 versions < 3.12.5-2.el8_10. Fixed in 3.12.5-2.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.12 is a high-level, dynamically typed programming language known for its emphasis on code readability and extensive standard library. It supports a wide range of applications and has a vast ecosystem of third-party libraries. The python3.12 package includes the reference interpreter for Python version 3, while its standard library is primarily provided in the python3.12-libs package. Additional components like python3.12-tkinter and python3.12-test may require separate installation. Documentation is available in the python3.12-docs package.
Vulnerability Detail
The vulnerabilities in Python 3.12 include incorrect handling of IPv4 and IPv6 private ranges (CVE-2024-4032), improper quoting of newlines in email headers within the email module leading to header injection (CVE-2024-6923), and a potential Denial of Service (DoS) when iterating over a malicious ZIP file (CVE-2024-8088). These vulnerabilities can lead to security breaches, data leaks, and service disruptions, making it crucial for users to address them promptly.
How To Fix
Minimum fixed version
3.12.5-2.el8_10
This is the first release that contains the fix.
sudo dnf update python3.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected features of the email module and refrain from processing untrusted ZIP files until the update is applied. However, this is not a long-term solution and updating is strongly recommended.
Conclusion
The security update for Python 3.12 addresses critical vulnerabilities that could lead to serious security issues. Users are strongly advised to update their packages to ensure the integrity and security of their applications. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for python3.12 →
FAQ
The main vulnerabilities include incorrect handling of private IP ranges, email header injection issues, and potential Denial of Service from malicious ZIP files.
You can use Vulert, which monitors and alerts for open-source vulnerabilities. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
It is recommended to update to version 3.12.5-2.el8_10 or later to mitigate the vulnerabilities.
Yes, Vulert provides real-time monitoring for open-source vulnerabilities without requiring code access or installation.
Detailed information can be found on the CVE pages for CVE-2024-4032, CVE-2024-6923, and CVE-2024-8088.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12.
