Moderate Security Update for Python 3.12: Addressing Multiple Vulnerabilities
Summary
ALSA-2024:9190: Moderate: python3.12 security update. Affects python3.12 versions < 3.12.5-2.el9. Fixed in 3.12.5-2.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Python 3.12 is a high-level, dynamically typed programming language known for its emphasis on code readability and extensive standard library. It is widely used in various applications, from web development to data analysis. The python3.12 package includes the reference interpreter for Python, while additional libraries and documentation are provided in related packages. This version has been found vulnerable to several security issues that could lead to denial of service and incorrect handling of private IP ranges.
Vulnerability Detail
The vulnerabilities in Python 3.12 include issues in the zipfile module that can be exploited to create zip-bombs, leading to denial of service (CVE-2024-0450). Additionally, there are incorrect definitions of IPv4 and IPv6 private ranges (CVE-2024-4032) and a risk of denial of service when iterating over malicious ZIP files (CVE-2024-8088). These vulnerabilities can be exploited by attackers to disrupt service availability and compromise the integrity of applications relying on Python.
How To Fix
Minimum fixed version
3.12.5-2.el9
This is the first release that contains the fix.
sudo dnf update python3.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid processing untrusted ZIP files and validate input data to prevent exploitation of the vulnerabilities until the packages are updated.
Conclusion
The security update for Python 3.12 addresses critical vulnerabilities that could lead to denial of service and incorrect handling of IP ranges. It is essential for users to update their packages to the latest version to ensure the security and stability of their applications. Utilizing tools like Vulert can further enhance vulnerability management.
See every vulnerability recorded for python3.12 →
FAQ
A zip-bomb is a malicious ZIP file designed to crash or render a system unusable by consuming excessive resources when decompressed.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
Failing to update may leave your application vulnerable to denial of service attacks and incorrect handling of network ranges, potentially leading to security breaches.
Environments that rely heavily on Python for web services, data processing, or any application that handles user-uploaded ZIP files are particularly at risk.
Vulert monitors and alerts for open-source vulnerabilities in software using a manifest file like package-lock.json, providing real-time insights into potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
