Important: python39:3.9 and python39-devel:3.9 security update
Summary
ALSA-2023:3811: Important: python39:3.9 and python39-devel:3.9 security update. Affects python39 versions < 3.9.16-1.module_el8.8.0+3577+f4afbb0e.1. Fixed in 3.9.16-1.module_el8.8.0+3577+f4afbb0e.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Vulnerability Detail
The vulnerability in Python (python39:3.9 and python39-devel:3.9) is related to urllib.parse url blocklisting bypass (CVE-2023-24329). This vulnerability allows an attacker to bypass the blocklisting mechanism in urllib.parse, potentially leading to various security issues. The impact of this vulnerability can vary depending on how urllib.parse is used in the affected application.
How To Fix
Minimum fixed version
3.9.16-1.module_el8.8.0+3577+f4afbb0e.1
This is the first release that contains the fix.
sudo dnf update python39Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the python39:3.9 and python39-devel:3.9 security update addresses a vulnerability related to urllib.parse url blocklisting bypass. It is important to update the affected packages to the fixed version to mitigate the potential security risks. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for python39 →
FAQ
The impact of this vulnerability can vary depending on how urllib.parse is used in the affected application. It could potentially lead to security issues such as bypassing blocklisting mechanisms.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will analyze it for open-source vulnerabilities in real-time.
No specific workaround has been provided for this vulnerability. It is recommended to update the python39 and python39-devel packages to the fixed version.
You can find more information about this vulnerability, including the CVE page, in the References section of the vulnerability details.
To update the python39 and python39-devel packages, you can use the package manager of your Linux distribution. Run the update command with the appropriate package names to install the latest version.
Related vulnerabilities
Recent vulnerabilities recorded for python39.
