Moderate: python39:3.9 and python39-devel:3.9 security update
Summary
ALSA-2021:4160: Moderate: python39:3.9 and python39-devel:3.9 security update. Affects python39-Cython versions < 0.29.21-5.module_el8.6.0+2780+a40f65e1. Fixed in 0.29.21-5.module_el8.6.0+2780+a40f65e1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high-level dynamic data types, and dynamic typing. Python supports interfaces to many system calls and libraries, as well as various windowing systems.
Vulnerability Detail
The following vulnerabilities have been identified in Python 3.9 and Python 3.9-devel:
- CVE-2021-3426: Information disclosure via pydoc
- CVE-2021-3733: Regular expression DoS in AbstractBasicAuthHandler
- CVE-2021-28957: Missing input sanitization for formaction HTML5 attributes may lead to XSS
- CVE-2021-29921: Improper input validation of octal strings
- CVE-2021-33503: ReDoS in the parsing of the authority part of URL
- CVE-2021-3572: Incorrect handling of unicode separators in git references
- CVE-2021-3737: HTTP client possible infinite loop on a 100 Continue response
These vulnerabilities can result in information disclosure, denial of service, cross-site scripting (XSS) attacks, and other security issues.
How To Fix
Minimum fixed version
0.29.21-5.module_el8.6.0+2780+a40f65e1
This is the first release that contains the fix.
sudo dnf update python39-CythonTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, it is important to update the affected Python packages to the fixed versions to mitigate the security vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python39-Cython →
FAQ
Python is an interpreted, interactive, object-oriented programming language that supports various system calls and libraries.
These vulnerabilities can result in information disclosure, denial of service, cross-site scripting (XSS) attacks, and other security issues.
To fix these vulnerabilities, update the affected packages to the fixed versions mentioned in the AlmaLinux Release Notes.
No specific workarounds have been mentioned for these vulnerabilities.
You can find more information about these vulnerabilities in the CVE pages listed in the References section of the AlmaLinux Release Notes.
Related vulnerabilities
Recent vulnerabilities recorded for python39-Cython.
