Critical Vulnerability in Python Packages: python3.5 and python3.8 Regression Issues
Summary
USN-7348-2: python3.5, python3.8 regression. Affects python3.5 versions < 3.5.2-2ubuntu0~16.04.4~14.04.1+esm6. Fixed in 3.5.2-2ubuntu0~16.04.4~14.04.1+esm6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used high-level programming language known for its readability and versatility. The affected packages, python3.5 and python3.8, are implementations of Python 3 that provide essential libraries and tools for developers. These packages are integral to many applications and systems, making their security paramount. Recent vulnerabilities have been identified that could potentially allow attackers to exploit weaknesses in the handling of IP addresses and virtual environments.
Vulnerability Detail
The vulnerabilities stem from incorrect handling of IP address ranges in the ipaddress module, improper quoting of path names in the venv module, and issues with parsing bracketed hosts and domain names. These flaws could lead to incorrect security policies, arbitrary code execution, and Server-Side Request Forgery (SSRF) attacks. Specifically, CVE-2024-4032 and CVE-2024-11168 affect Ubuntu 14.04 LTS and 16.04 LTS, while CVE-2024-9287 and CVE-2025-0938 could impact broader systems.
How To Fix
Minimum fixed version
3.5.2-2ubuntu0~16.04.4~14.04.1+esm6
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python3.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using the affected features of the ipaddress and venv modules until the packages are updated. Additionally, ensure that virtual environments are not activated by untrusted users to mitigate the risk of arbitrary code execution.
Conclusion
In summary, critical vulnerabilities have been identified in the python3.5 and python3.8 packages that could lead to severe security risks. It is essential for users to update their packages to the latest patched versions to protect their applications from potential exploits. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for python3.5 →
FAQ
The main vulnerabilities include incorrect handling of IP address ranges, improper quoting of path names, and issues with parsing bracketed hosts and domain names, leading to potential security risks.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
These vulnerabilities could allow attackers to execute arbitrary code, apply incorrect security policies, and perform SSRF attacks, compromising the security of applications.
Yes, patched versions of python3.5 and python3.8 are available. Users should update to the specified versions to mitigate the vulnerabilities.
If immediate updates are not possible, avoid using the affected features and restrict access to virtual environments to trusted users as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for python3.5.
