Critical Security Update for Python 3.9: Addressing Arbitrary Code Execution Vulnerabilities
Summary
ALSA-2026:10949: Important: python3.9 security update. Affects python-unversioned-command versions < 3.9.25-3.el9_7.3. Fixed in 3.9.25-3.el9_7.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.9 is an interpreted, interactive, object-oriented programming language widely used for various applications, including web development, data analysis, artificial intelligence, and more. It features dynamic typing, high-level data types, and extensive libraries, making it a versatile choice for developers. However, recent vulnerabilities have been identified that could allow attackers to execute arbitrary code or disclose sensitive information through specific modules.
Vulnerability Detail
The vulnerabilities in Python 3.9 arise from a use-after-free issue in decompression modules and a command injection flaw in the webbrowser.open() API. These vulnerabilities can lead to arbitrary code execution, allowing an attacker to execute malicious code on the affected system or disclose sensitive information, posing significant risks to users and applications relying on this version of Python.
How To Fix
Minimum fixed version
3.9.25-3.el9_7.3
This is the first release that contains the fix.
sudo dnf update python-unversioned-commandTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected features of the Python library until the update is applied. Specifically, refrain from using the webbrowser.open() API and any decompression modules that may trigger the vulnerabilities.
Conclusion
The identified vulnerabilities in Python 3.9 pose significant risks, including arbitrary code execution and information disclosure. It is crucial for users and developers to update to the patched version 3.9.25-3.el9_7.3 to ensure the security of their applications. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for python-unversioned-command →
FAQ
The vulnerabilities involve arbitrary code execution and information disclosure due to flaws in decompression modules and the webbrowser.open() API.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
If an immediate update is not possible, avoid using the affected features until the update can be applied.
The vulnerabilities can lead to unauthorized code execution, which may compromise system security and lead to data breaches.
Yes, upgrade to Python 3.9.25-3.el9_7.3 to mitigate the vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for python-unversioned-command.
