ALSA-2023:3595 - Important: python3.9 security update
Summary
ALSA-2023:3595: Important: python3.9 security update. Affects python-unversioned-command versions < 3.9.16-1.el9_2.1. Fixed in 3.9.16-1.el9_2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Vulnerability Detail
The vulnerability identified as CVE-2023-24329 is a security issue in the urllib.parse module of Python. It allows for a bypass of URL blocklisting. This vulnerability can potentially be exploited to perform unauthorized actions or access restricted resources. The impact and severity of the vulnerability are further detailed in the CVE page linked in the References section.
How To Fix
Minimum fixed version
3.9.16-1.el9_2.1
This is the first release that contains the fix.
sudo dnf update python-unversioned-commandTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the Python packages listed in the 'affected' section are vulnerable to CVE-2023-24329. To mitigate the risk, it is crucial to update these packages to version 3.9.16-1.el9_2.1 or later. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for python-unversioned-command →
FAQ
This vulnerability allows for a bypass of URL blocklisting in the urllib.parse module of Python, potentially leading to unauthorized actions or access to restricted resources.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
It is recommended to update the affected Python packages to version 3.9.16-1.el9_2.1 or later to fix this vulnerability.
No specific workarounds have been mentioned for this vulnerability. Updating to the fixed version is the recommended solution.
You can refer to the CVE page linked in the References section for more details about the vulnerability, including its impact, CVSS score, acknowledgments, and other related information.
Related vulnerabilities
Recent vulnerabilities recorded for python-unversioned-command.
