Important: python39:3.9 security update
Summary
ALSA-2022:8492: Important: python39:3.9 security update. Affects python39 versions < 3.9.13-2.module_el8.7.0+3351+e02cdf9b. Fixed in 3.9.13-2.module_el8.7.0+3351+e02cdf9b. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Vulnerability Detail
The vulnerability (CVE-2022-42919) in Python allows for local privilege escalation via the multiprocessing forkserver start method. This vulnerability can potentially allow an attacker to gain elevated privileges on the affected system.
How To Fix
Minimum fixed version
3.9.13-2.module_el8.7.0+3351+e02cdf9b
This is the first release that contains the fix.
sudo dnf update python39Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
It is crucial to update the python39 package to the latest version (3.9.13-2.module_el8.7.0+3351+e02cdf9b or later) to mitigate the privilege escalation vulnerability. Failure to do so may expose the system to potential unauthorized access or control. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python39 →
FAQ
This vulnerability can allow an attacker to escalate their privileges on the affected system, potentially gaining unauthorized access or control.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and the playground will analyze it for any open-source vulnerabilities, including this one.
At the moment, there are no known workarounds for this vulnerability. It is recommended to update the python39 package to the latest version to mitigate the risk.
There is currently no evidence of this vulnerability being actively exploited in the wild. However, it is still important to apply the necessary security updates to protect against potential future attacks.
You can find more information about this vulnerability, including the CVE page and related references, in the official advisory provided by AlmaLinux: https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2022:8492.json
Related vulnerabilities
Recent vulnerabilities recorded for python39.
