Moderate: python39:3.9 and python39-devel:3.9 security update
Summary
ALSA-2024:5962: Moderate: python39:3.9 and python39-devel:3.9 security update. Affects python39 versions < 3.9.19-7.module_el8.10.0+3885+d986a391. Fixed in 3.9.19-7.module_el8.10.0+3885+d986a391. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Vulnerability Detail
The vulnerability affects the python39 and python39-devel packages in the AlmaLinux:8 ecosystem. It includes the following security issues:
- CVE-2024-4032: Incorrect IPv4 and IPv6 private ranges
- CVE-2024-6345: Remote code execution via download functions in the package_index module in pypa/setuptools
- CVE-2024-6923: Email module doesn't properly quote newlines in email headers, allowing header injection
- CVE-2024-8088: From NVD collector
These vulnerabilities can have various impacts and may lead to unauthorized access, remote code execution, or header injection.
How To Fix
Minimum fixed version
3.9.19-7.module_el8.10.0+3885+d986a391
This is the first release that contains the fix.
sudo dnf update python39Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The python39 and python39-devel packages in the AlmaLinux:8 ecosystem are affected by multiple security vulnerabilities. To mitigate these risks, it is recommended to update the packages to the fixed versions.
See every vulnerability recorded for python39 →
FAQ
The impact of these vulnerabilities can range from unauthorized access to remote code execution and header injection. It is important to update the affected packages to mitigate these risks.
You can update the packages by running the package manager update command for the AlmaLinux:8 ecosystem. For example, you can use the following command: sudo yum update python39 python39-devel.
No specific workarounds are mentioned for these vulnerabilities. It is recommended to update the packages to the fixed versions.
You can find more information about these vulnerabilities, including their CVE pages, in the References section of the vulnerability details.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities, to check if your application is affected. Vulert uses a manifest file like package-lock.json to provide real-time vulnerability monitoring and alerts.
Related vulnerabilities
Recent vulnerabilities recorded for python39.
