Moderate: python38:3.8 and python38-devel:3.8 security update
Summary
ALSA-2022:1764: Moderate: python38:3.8 and python38-devel:3.8 security update. Affects python38 versions < 3.8.12-1.module_el8.6.0+2778+cd494b30. Fixed in 3.8.12-1.module_el8.6.0+2778+cd494b30. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Vulnerability Detail
The python38:3.8 and python38-devel:3.8 packages are affected by multiple security vulnerabilities:
- CVE-2021-3733: A regular expression denial of service (DoS) vulnerability in AbstractBasicAuthHandler of the urllib module.
- CVE-2021-43818: A vulnerability in the HTML Cleaner module of python-lxml that allows crafted and SVG embedded scripts to pass through.
- CVE-2022-0391: A vulnerability in urllib.parse that allows URLs containing ASCII newline and tabs to bypass sanitization.
- CVE-2021-3737: A vulnerability in urllib that can lead to an infinite loop on a 100 Continue response.
How To Fix
Minimum fixed version
3.8.12-1.module_el8.6.0+2778+cd494b30
This is the first release that contains the fix.
sudo dnf update python38Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities.
Conclusion
In conclusion, the python38:3.8 and python38-devel:3.8 packages are affected by multiple security vulnerabilities. It is recommended to upgrade to the latest version to mitigate these vulnerabilities. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for python38 →
FAQ
These vulnerabilities could allow an attacker to cause a denial of service, bypass URL sanitization, or execute arbitrary scripts.
There are no known exploits for these vulnerabilities at this time.
The CVSS scores for these vulnerabilities have not been provided in the vulnerability details.
The vulnerability details do not mention any acknowledgments.
You can find more information about these vulnerabilities on the CVE pages listed in the References section of the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for python38.
