ALSA-2023:3585 - Important: python3.11 security update
Summary
ALSA-2023:3585: Important: python3.11 security update. Affects python3.11 versions < 3.11.2-2.el9_2.1. Fixed in 3.11.2-2.el9_2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries.
Vulnerability Detail
The vulnerability identified as CVE-2023-24329 affects the urllib.parse module in Python. It allows for a bypass of the URL blocklisting mechanism, potentially leading to unauthorized access or other security issues. The impact and severity of this vulnerability are significant, and it is crucial to address it promptly.
How To Fix
Minimum fixed version
3.11.2-2.el9_2.1
This is the first release that contains the fix.
sudo dnf update python3.11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability. It is advised to follow the recommended fix and update the affected package to the latest version.
Conclusion
It is crucial to address this vulnerability by updating the affected python3.11 package to version 3.11.2-2.el9_2.1 or later. Failure to do so may expose systems to potential security risks. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python3.11 →
FAQ
Python is a popular programming language known for its simplicity and readability. It is widely used for various applications, including web development, data analysis, and artificial intelligence.
urllib.parse is a module in Python's standard library that provides functions for parsing URLs and manipulating URL components.
The vulnerability allows for a bypass of the URL blocklisting mechanism, which can potentially lead to unauthorized access or other security issues. It is important to update the affected package to mitigate these risks.
To update the python3.11 package, you can use the package manager specific to your operating system. For example, on AlmaLinux 9, you can use the package manager command 'yum update python3.11' to install the latest version.
You can find more information about this vulnerability, including the CVE page and related details, in the References section of the advisory. The advisory also provides a link to the AlmaLinux OSV database for additional information.
Related vulnerabilities
Recent vulnerabilities recorded for python3.11.
