Moderate: python39:3.9 and python39-devel:3.9 security update
Summary
ALSA-2024:2985: Moderate: python39:3.9 and python39-devel:3.9 security update. Affects python39 versions < 3.9.18-3.module_el8.10.0+3765+2f9a457d. Fixed in 3.9.18-3.module_el8.10.0+3765+2f9a457d. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high-level dynamic data types, and dynamic typing. Python supports interfaces to many system calls and libraries, as well as various windowing systems.
Vulnerability Detail
The vulnerability affects the python39:3.9 and python39-devel:3.9 packages. It includes the following security issues:
- pypa-setuptools: Regular Expression Denial of Service (ReDoS) in package_index.py (CVE-2022-40897)
- python-cryptography: memory corruption via immutable objects (CVE-2023-23931)
- python: Parsing errors in email/_parseaddr.py lead to incorrect value in email address part of tuple (CVE-2023-27043)
- python-urllib3: Cookie request header isn't stripped during cross-origin redirects (CVE-2023-43804)
These vulnerabilities can lead to various security risks, including denial of service, memory corruption, and incorrect parsing of email addresses.
How To Fix
Minimum fixed version
3.9.18-3.module_el8.10.0+3765+2f9a457d
This is the first release that contains the fix.
sudo dnf update python39Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no mentioned workarounds for these vulnerabilities.
Conclusion
In conclusion, the python39:3.9 and python39-devel:3.9 packages are affected by multiple security vulnerabilities. It is recommended to update these packages to the latest version to mitigate the risks associated with these vulnerabilities. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for python39 →
FAQ
These vulnerabilities can lead to denial of service, memory corruption, and incorrect parsing of email addresses, potentially allowing attackers to exploit the affected systems.
There are no known exploits for these vulnerabilities at the time of this report.
Yes, these vulnerabilities can be exploited remotely.
The CVSS scores for these vulnerabilities are not provided in the available information.
You can find more information about these vulnerabilities, including the impact, acknowledgments, and related CVE pages, in the references section of the original advisory.
Related vulnerabilities
Recent vulnerabilities recorded for python39.
