Moderate: python38:3.8 security, bug fix, and enhancement update
Summary
ALSA-2020:4641: Moderate: python38:3.8 security, bug fix, and enhancement update. Affects python38-Cython versions < 0.29.14-4.module_el8.6.0+2778+cd494b30. Fixed in 0.29.14-4.module_el8.6.0+2778+cd494b30. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Vulnerability Detail
This vulnerability affects the python38 package in version 3.8.3. It includes several security fixes, bug fixes, and enhancements. The security fixes address the following vulnerabilities:
- PyYAML: command execution through python/object/apply constructor in FullLoader (CVE-2019-20477)
- python: infinite loop in the tarfile module via crafted TAR archive (CVE-2019-20907)
- PyYAML: arbitrary command execution through python/object/new when FullLoader is used (CVE-2020-1747)
- python: wrong backtracking in urllib.request.AbstractBasicAuthHandler allows for a ReDoS (CVE-2020-8492)
- python: DoS via inefficiency in IPv{4,6}Interface classes (CVE-2020-14422)
For more details about the security issues, including the impact, CVSS score, acknowledgments, and related information, refer to the CVE pages listed in the References section.
How To Fix
Minimum fixed version
0.29.14-4.module_el8.6.0+2778+cd494b30
This is the first release that contains the fix.
sudo dnf update python38-CythonTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability.
Conclusion
The python38 package has been updated to version 3.8.3 to address several security vulnerabilities. It is recommended to upgrade to this version to ensure the security and stability of your Python environment. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for python38-Cython →
FAQ
Python is an interpreted, interactive, object-oriented programming language.
The vulnerability affects python38 version 3.8.3.
The security fixes address command execution, infinite loop, arbitrary command execution, backtracking, and denial of service vulnerabilities.
To upgrade the python38 package, follow the upgrade instructions provided by the package maintainers.
No, there are no known workarounds for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for python38-Cython.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
