Important: python38:3.8 and python38-devel:3.8 security update
Summary
ALSA-2023:3781: Important: python38:3.8 and python38-devel:3.8 security update. Affects python38 versions < 3.8.16-1.module_el8.8.0+3576+cd671ecd.1. Fixed in 3.8.16-1.module_el8.8.0+3576+cd671ecd.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Vulnerability Detail
The vulnerability (CVE-2023-24329) in the urllib.parse module of Python allows for URL blocklisting bypass. This vulnerability can be exploited to bypass security measures put in place to block certain URLs. The impact of this vulnerability can vary depending on the specific implementation and usage of the urllib.parse module.
How To Fix
Minimum fixed version
3.8.16-1.module_el8.8.0+3576+cd671ecd.1
This is the first release that contains the fix.
sudo dnf update python38Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, it is important to update the python38 and python38-devel packages to the latest version to mitigate the vulnerability. This can be done by running the appropriate package manager command for your operating system. If you have any further questions or need assistance with vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for python38 →
FAQ
The impact of this vulnerability can vary depending on the specific implementation and usage of the urllib.parse module. It could potentially allow for the bypassing of URL blocklisting measures.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, a security update is available for the python38 and python38-devel packages. It is recommended to update to version 3.8.16-1.module_el8.8.0+3576+cd671ecd.1 or later.
No specific workarounds have been mentioned for this vulnerability.
You can refer to the CVE page for more details about this vulnerability. The CVE ID is CVE-2023-24329.
Related vulnerabilities
Recent vulnerabilities recorded for python38.
