Moderate Security Update for Python 3.9: Addressing Vulnerabilities in AlmaLinux
Summary
ALSA-2024:10983: Moderate: python3.9:3.9.21 security update. Affects python-unversioned-command versions < 3.9.21-1.el9_5. Fixed in 3.9.21-1.el9_5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used interpreted, interactive, object-oriented programming language known for its simplicity and versatility. It supports modules, classes, exceptions, and dynamic data types, making it suitable for various applications, from web development to data analysis. The recent vulnerabilities identified in Python 3.9.21 affect its virtual environment activation scripts and the validation of IPv6 addresses, posing potential security risks to applications relying on this version.
Vulnerability Detail
The vulnerabilities in Python 3.9.21 stem from two main issues: first, the virtual environment (venv) activation scripts do not quote paths, which can lead to command injection vulnerabilities (CVE-2024-9287). Second, there is improper validation of IPv6 and IPvFuture addresses, which could allow attackers to exploit applications that rely on these addresses (CVE-2024-11168). These vulnerabilities can lead to unauthorized access or execution of arbitrary commands, compromising the security of applications.
How To Fix
Minimum fixed version
3.9.21-1.el9_5
This is the first release that contains the fix.
sudo dnf update python-unversioned-commandTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can manually quote paths in your virtual environment activation scripts to mitigate the risk of command injection until the update is applied. Ensure that any IPv6 addresses used in your applications are validated properly to avoid exploitation.
Conclusion
The vulnerabilities identified in Python 3.9.21 pose significant security risks that can affect applications relying on this version. It is crucial to update to the patched version 3.9.21-1.el9_5 to mitigate these risks. For those unable to update immediately, implementing workarounds can help reduce the potential impact.
See every vulnerability recorded for python-unversioned-command →
FAQ
The main vulnerabilities are related to unquoted paths in virtual environment activation scripts and improper validation of IPv6 addresses.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without signing up.
These vulnerabilities can lead to unauthorized access and execution of arbitrary commands, potentially compromising the security of applications.
Yes, a patch is available in version 3.9.21-1.el9_5. Updating to this version will fix the vulnerabilities.
If immediate updating is not possible, manually quote paths in activation scripts and ensure proper validation of IPv6 addresses as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for python-unversioned-command.
