Moderate: python39:3.9 and python39-devel:3.9 security update
Summary
ALSA-2022:1763: Moderate: python39:3.9 and python39-devel:3.9 security update. Affects python39 versions < 3.9.7-1.module_el8.6.0+2780+a40f65e1. Fixed in 3.9.7-1.module_el8.6.0+2780+a40f65e1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Vulnerability Detail
The python-lxml package is affected by a vulnerability (CVE-2021-43818) in the HTML Cleaner component. This vulnerability allows crafted and SVG embedded scripts to pass through, potentially leading to code execution or other malicious activities. The impact of this vulnerability is considered moderate.
How To Fix
Minimum fixed version
3.9.7-1.module_el8.6.0+2780+a40f65e1
This is the first release that contains the fix.
sudo dnf update python39Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability at this time.
Conclusion
In conclusion, the python39:3.9 and python39-devel:3.9 packages are affected by a moderate security vulnerability (CVE-2021-43818) in the python-lxml package. It is recommended to update the affected packages to the latest version to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python39 →
FAQ
This vulnerability allows crafted and SVG embedded scripts to pass through, potentially leading to code execution or other malicious activities.
There is no known workaround for this vulnerability at this time.
To fix this vulnerability, it is recommended to update the python39 and python39-devel packages to version 3.9.7-1.module_el8.6.0+2780+a40f65e1 or later.
More information about this vulnerability can be found on the CVE page: CVE-2021-43818.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will analyze it for open-source vulnerabilities in real-time.
References
Related vulnerabilities
Recent vulnerabilities recorded for python39.
