Moderate: python39:3.9 and python39-devel:3.9 security update
Summary
ALSA-2023:2764: Moderate: python39:3.9 and python39-devel:3.9 security update. Affects python39 versions < 3.9.16-1.module_el8.8.0+3483+a028a3dd. Fixed in 3.9.16-1.module_el8.8.0+3483+a028a3dd. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Vulnerability Detail
The vulnerability (CVE-2020-10735) in Python allows an attacker to cause a denial of service (DoS) by exploiting the int() type in PyLong_FromString() function, which does not limit the amount of digits when converting text to an integer. This can lead to resource exhaustion and potentially impact the availability of the affected system. Another vulnerability (CVE-2021-28861) allows for open redirection in lib/http/server.py, which may lead to information disclosure. Additionally, a CPU denial of service can be triggered by an inefficient IDNA decoder (CVE-2022-45061). These vulnerabilities have been addressed in the python39 and python39-devel packages.
How To Fix
Minimum fixed version
3.9.16-1.module_el8.8.0+3483+a028a3dd
This is the first release that contains the fix.
sudo dnf update python39Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities.
Conclusion
In conclusion, it is important to update the python39 and python39-devel packages to address the vulnerabilities mentioned in this report. Failure to do so may result in resource exhaustion, denial of service, or potential information disclosure. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python39 →
FAQ
The impact of these vulnerabilities can range from resource exhaustion and denial of service to potential information disclosure.
You can use tools like Vulert (https://vulert.com) to check if your system is affected by these vulnerabilities. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in the software.
There are no known exploits for these vulnerabilities at the time of this report.
For more details about these vulnerabilities, including the impact, CVSS score, acknowledgments, and related information, refer to the CVE pages listed in the References section of the original advisory.
The AlmaLinux Release Notes can be found by following the link provided in the References section of the original advisory.
Related vulnerabilities
Recent vulnerabilities recorded for python39.
