Moderate Security Vulnerability in Python 3.12: Header Injection and Command Injection Issues
Summary
RLSA-2026:4713: Moderate: python3.12 security update. Affects python3.12 versions < 0:3.12.12-3.el10_1.1. Fixed in 0:3.12.12-3.el10_1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.12 is an interpreted, interactive, object-oriented programming language known for its versatility and ease of use. It supports dynamic data types, classes, and modules, making it a popular choice for developers. However, recent security vulnerabilities have been identified that could potentially compromise the integrity of applications using this version.
Vulnerability Detail
The vulnerabilities in Python 3.12 include header newline injection in the wsgiref.headers module, IMAP command injection in user-controlled commands, POP3 command injection in user-controlled commands, and email header injection due to unquoted newlines. These vulnerabilities can lead to unauthorized access, data leakage, and manipulation of email headers, posing significant risks to applications that rely on these functionalities.
How To Fix
Minimum fixed version
0:3.12.12-3.el10_1.1
This is the first release that contains the fix.
sudo dnf update python3.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can sanitize user inputs to prevent command injection and ensure that headers are properly formatted to avoid newline injection. For example, validate and escape any user input that will be included in headers or commands.
Conclusion
In summary, Python 3.12 has several moderate security vulnerabilities that can impact applications relying on its features. It is crucial to update to the latest patched version to mitigate these risks. Additionally, employing input validation and using tools like Vulert can help monitor and address vulnerabilities effectively.
See every vulnerability recorded for python3.12 →
FAQ
The main vulnerabilities include header newline injection, IMAP command injection, POP3 command injection, and email header injection due to unquoted newlines.
These vulnerabilities can lead to unauthorized access, data leakage, and manipulation of email headers, which can compromise the security and integrity of your application.
Yes, a patched version of Python 3.12 is available. You should update to version 3.12.12-3.el10_1.1 or later.
You can update Python 3.12 by running 'sudo yum update python3.12' in your terminal.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground at Vulert Scanner without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for python3.12.
