Moderate: python3.11 security update
Summary
ALSA-2024:6179: Moderate: python3.11 security update. Affects python3.11 versions < 3.11.7-1.el9_4.5. Fixed in 3.11.7-1.el9_4.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Vulnerability Detail
The email module in Python doesn't properly quote newlines in email headers, allowing header injection. This vulnerability is identified as CVE-2024-6923. An attacker can exploit this vulnerability to inject malicious content into email headers, potentially leading to various attacks such as phishing, spoofing, or remote code execution.
How To Fix
Minimum fixed version
3.11.7-1.el9_4.5
This is the first release that contains the fix.
sudo dnf update python3.11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the security update to mitigate the risk.
Conclusion
The python3.11 package is affected by a moderate security vulnerability that allows header injection in email headers. This can lead to various attacks such as phishing, spoofing, or remote code execution. It is crucial to update to version 3.11.7-1.el9_4.5 or later to mitigate the risk.
See every vulnerability recorded for python3.11 →
FAQ
The vulnerability allows an attacker to inject malicious content into email headers, potentially leading to various attacks such as phishing, spoofing, or remote code execution.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Yes, a security update is available for the python3.11 package. It is recommended to update to version 3.11.7-1.el9_4.5 or later.
There are no known workarounds for this vulnerability. Applying the security update is the recommended solution.
You can refer to the CVE page for CVE-2024-6923 for more details about the impact, CVSS score, acknowledgments, and related information.
Related vulnerabilities
Recent vulnerabilities recorded for python3.11.
