Moderate Security Vulnerability in Python 3.12: Multiple Denial of Service Issues
Summary
RLSA-2024:9190: Moderate: python3.12 security update. Affects python3.12 versions < 0:3.12.5-2.el9_5.2. Fixed in 0:3.12.5-2.el9_5.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.12 is a high-level, dynamically typed programming language known for its emphasis on code readability and extensive standard library. It serves as the reference interpreter for the Python language and is widely used in various applications. The python3.12 package includes the core interpreter, while additional libraries and documentation are provided in separate packages. However, recent vulnerabilities have been identified that could compromise the security of applications relying on this version.
Vulnerability Detail
The vulnerabilities in Python 3.12 include issues in the zipfile module that can lead to zip-bombs causing denial of service (CVE-2024-0450), incorrect handling of IPv4 and IPv6 private ranges (CVE-2024-4032), and potential denial of service when iterating over malicious ZIP files (CVE-2024-8088). These vulnerabilities can be exploited by attackers to disrupt service availability, potentially leading to significant operational impacts.
How To Fix
Minimum fixed version
0:3.12.5-2.el9_5.2
This is the first release that contains the fix.
sudo dnf update python3.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid processing untrusted ZIP files and validate the contents of ZIP archives before extraction to mitigate the risk of denial of service attacks.
Conclusion
The vulnerabilities identified in Python 3.12 present significant risks, particularly related to denial of service attacks. It is crucial for users and developers to update their packages promptly and implement recommended workarounds to safeguard their applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for python3.12 →
FAQ
A zip-bomb is a malicious ZIP file designed to crash or disrupt the system that attempts to unpack it by consuming excessive resources.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploiting these vulnerabilities can lead to denial of service, making applications unavailable and potentially causing data loss or operational disruptions.
While it is not advisable to continue using an affected version, applying the security updates promptly will mitigate the risks associated with these vulnerabilities.
If immediate updates are not possible, implement workarounds such as avoiding untrusted ZIP files and validating ZIP contents to minimize exposure.
References
Related vulnerabilities
Recent vulnerabilities recorded for python3.12.
