Security Update for Python 3.12: Addressing Critical Vulnerabilities
Summary
ALSA-2026:0123: Moderate: python3.12 security update. Affects python3.12 versions < 3.12.12-1.el8_10. Fixed in 3.12.12-1.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.12 is an interpreted, interactive, object-oriented programming language widely used for various applications, including web development, data analysis, artificial intelligence, and more. It features modules, classes, exceptions, and high-level dynamic data types, making it a versatile choice for developers. However, recent vulnerabilities have been identified that could compromise the security of applications using this version.
Vulnerability Detail
The vulnerabilities in Python 3.12 stem from two main issues: the first involves the zipfile module, where the End of Central Directory (EOCD) Locator record offset is not properly checked, potentially allowing attackers to exploit this oversight. The second vulnerability is a quadratic algorithm in the xml.dom.minidom module, which can lead to denial of service (DoS) attacks. Both vulnerabilities could allow malicious actors to disrupt services or gain unauthorized access to sensitive data.
How To Fix
Minimum fixed version
3.12.12-1.el8_10
This is the first release that contains the fix.
sudo dnf update python3.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for these vulnerabilities. The best course of action is to apply the security update as soon as possible.
Conclusion
In summary, Python 3.12 has critical vulnerabilities that could impact the security of applications using this version. It is crucial to update to the latest patched version to mitigate these risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your software.
See every vulnerability recorded for python3.12 →
FAQ
The main vulnerabilities include an unchecked EOCD Locator record offset in the zipfile module and a quadratic algorithm issue in the xml.dom.minidom module.
These vulnerabilities can lead to denial of service attacks and unauthorized access to sensitive data, compromising the security and functionality of your application.
Yes, a patch is available in version 3.12.12-1.el8_10. It is recommended to update to this version to secure your application.
You can update Python 3.12 using the command: 'sudo dnf update python3.12'.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just a manifest file like package-lock.json. You can check your application for vulnerabilities using the Vulert playground at Vulert Scanner.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12.
