Moderate: python-wheel security update
Summary
ALSA-2023:6712: Moderate: python-wheel security update. Affects python3-wheel versions < 1:0.36.2-8.el9. Fixed in 1:0.36.2-8.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python-wheel is the reference implementation of the Python wheel packaging standard, as defined in PEP 427. It provides a format for distributing Python packages and is widely used in the Python ecosystem. The package allows for the creation, distribution, and installation of Python packages, making it an essential component for developers and users alike.
Vulnerability Detail
The vulnerability identified in python-wheel is a remote code execution vulnerability, tracked as CVE-2022-40898. Attackers can exploit this vulnerability by providing malicious input to the wheel command-line interface (CLI), leading to a denial of service (DoS) condition. This vulnerability can be triggered remotely, allowing attackers to disrupt the normal functioning of the affected system. The impact of this vulnerability can range from service disruption to potential unauthorized access to sensitive information.
How To Fix
Minimum fixed version
1:0.36.2-8.el9
This is the first release that contains the fix.
sudo dnf update python3-wheelTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the security update as soon as possible to protect the system from potential attacks.
Conclusion
The python-wheel package is susceptible to a remote code execution vulnerability that can lead to a denial of service condition. It is crucial to update the package to the latest version to mitigate the risk of potential attacks. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python3-wheel →
FAQ
Python-wheel is the reference implementation of the Python wheel packaging standard, providing a format for distributing Python packages.
The vulnerability allows remote attackers to cause a denial of service (DoS) condition, potentially leading to service disruption or unauthorized access to sensitive information.
To fix this vulnerability, update the python-wheel package to version 1:0.36.2-8.el9 or later.
No, there is no known workaround for this vulnerability. It is essential to apply the security update.
For more details about this vulnerability, including the impact and technical details, refer to the CVE page(s) listed in the References section.
Related vulnerabilities
Recent vulnerabilities recorded for python3-wheel.
