Moderate: python39:3.9 and python39-devel:3.9 security update
Summary
ALSA-2023:7034: Moderate: python39:3.9 and python39-devel:3.9 security update. Affects python39 versions < 3.9.18-1.module_el8.9.0+3672+853baa42. Fixed in 3.9.18-1.module_el8.9.0+3672+853baa42. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Vulnerability Detail
The vulnerability affects the python39:3.9 and python39-devel:3.9 packages. It includes two security issues:
-
Tarfile module directory traversal (CVE-2007-4559): This vulnerability allows an attacker to traverse directories outside of the intended path when extracting tar archives, potentially leading to unauthorized access or overwriting of files.
-
Unintended leak of Proxy-Authorization header (CVE-2023-32681): This vulnerability in the python-requests package unintentionally leaks the Proxy-Authorization header, potentially exposing sensitive information to attackers.
These vulnerabilities can be exploited by remote attackers to compromise the affected system or gain unauthorized access to sensitive information.
How To Fix
Minimum fixed version
3.9.18-1.module_el8.9.0+3672+853baa42
This is the first release that contains the fix.
sudo dnf update python39Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the python39:3.9 and python39-devel:3.9 packages are affected by two security vulnerabilities. To mitigate the risk, it is recommended to update the packages to the latest version. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for python39 →
FAQ
The tarfile module directory traversal vulnerability allows an attacker to access files outside of the intended directory, potentially leading to unauthorized access or overwriting of files.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by these vulnerabilities. Simply upload your package-lock.json file and it will analyze the dependencies and alert you if any vulnerabilities are found.
No, there is no known workaround for these vulnerabilities. It is recommended to update the affected packages to the latest version.
There are no known exploits for these vulnerabilities at the moment. However, it is important to update the packages as soon as possible to mitigate the risk.
You can find more information about these vulnerabilities, including the impact, CVSS score, and acknowledgments, on the CVE pages: CVE-2007-4559 and CVE-2023-32681.
Related vulnerabilities
Recent vulnerabilities recorded for python39.
