Moderate: python38:3.8 security update
Summary
ALSA-2021:1879: Moderate: python38:3.8 security update. Affects python38-Cython versions < 0.29.14-4.module_el8.6.0+2778+cd494b30. Fixed in 0.29.14-4.module_el8.6.0+2778+cd494b30. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Vulnerability Detail
The vulnerability (CVE-2020-26116) in python allows for CRLF injection via HTTP request method in httplib/http.client. Another vulnerability (CVE-2020-27783) in python-lxml leads to mXSS due to the use of an improper parser. Additionally, there is a stack-based buffer overflow in PyCArg_repr in _ctypes/callproc.c (CVE-2021-3177). These vulnerabilities can potentially be exploited to execute arbitrary code or conduct cross-site scripting attacks.
How To Fix
Minimum fixed version
0.29.14-4.module_el8.6.0+2778+cd494b30
This is the first release that contains the fix.
sudo dnf update python38-CythonTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the python38 package is affected by multiple security vulnerabilities. It is recommended to update the package to the latest version to mitigate the risks associated with these vulnerabilities. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for python38-Cython →
FAQ
Python is an interpreted, interactive, object-oriented programming language.
CRLF injection is a type of web application vulnerability that allows an attacker to inject arbitrary HTTP headers into a response.
mXSS stands for 'mutation-based Cross-Site Scripting' and refers to a type of cross-site scripting vulnerability that occurs due to the use of an improper parser.
A stack-based buffer overflow is a type of software vulnerability where a program writes more data to a buffer than it can hold, causing the excess data to overflow into adjacent memory locations on the stack.
To update the python38 package, you can use the package manager specific to your operating system. For example, on AlmaLinux, you can use the 'yum' package manager to update the package.
Related vulnerabilities
Recent vulnerabilities recorded for python38-Cython.
