Moderate: python38:3.8 and python38-devel:3.8 security update
Summary
ALSA-2021:4162: Moderate: python38:3.8 and python38-devel:3.8 security update. Affects python38-Cython versions < 0.29.14-4.module_el8.6.0+2778+cd494b30. Fixed in 0.29.14-4.module_el8.6.0+2778+cd494b30. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Vulnerability Detail
This security update addresses multiple vulnerabilities in the Python 3.8 packages. These vulnerabilities include:
- CVE-2019-18874: Double free because of refcount mishandling in python-psutil
- CVE-2020-28493: ReDoS vulnerability in the urlize filter in python-jinja2
- CVE-2021-3426: Information disclosure via pydoc in python
- CVE-2021-20095, CVE-2021-42771: Relative path traversal allows an attacker to load arbitrary locale files and execute arbitrary code in python-babel
- CVE-2021-23336: Web cache poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a semicolon in query parameters in python
- CVE-2021-28957: Missing input sanitization for formaction HTML5 attributes may lead to XSS in python-lxml
- CVE-2021-29921: Improper input validation of octal strings in python-ipaddress
- CVE-2021-33503: ReDoS in the parsing of authority part of URL in python-urllib3
- CVE-2021-3572: Incorrect handling of unicode separators in git references in python-pip
For more details about each vulnerability, including the impact and CVSS score, please refer to the CVE pages listed in the References section.
How To Fix
Minimum fixed version
0.29.14-4.module_el8.6.0+2778+cd494b30
This is the first release that contains the fix.
sudo dnf update python38-CythonTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, this security update addresses multiple vulnerabilities in the Python 3.8 packages. It is recommended to update the affected packages to the fixed versions to mitigate the risks associated with these vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python38-Cython →
FAQ
Python is an interpreted, interactive, object-oriented programming language.
This security update addresses multiple vulnerabilities, including double free, ReDoS, information disclosure, arbitrary code execution, web cache poisoning, XSS, improper input validation, and incorrect handling of unicode separators.
The impact of these vulnerabilities can vary depending on the specific vulnerability, but they can potentially lead to security breaches, information disclosure, and remote code execution.
To fix these vulnerabilities, it is recommended to update the affected Python packages to the fixed versions. Please refer to the AlmaLinux Release Notes for detailed instructions.
For more information about each vulnerability, including the impact and CVSS score, please refer to the CVE pages listed in the References section.
Related vulnerabilities
Recent vulnerabilities recorded for python38-Cython.
