Headline
Debian Security Advisory 5759-1
Debian Linux Security Advisory 5759-1 - Multiple security issues were discovered in Python, a high-level, interactive, object-oriented language.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Debian Security Advisory DSA-5759-1 [email protected]
https://www.debian.org/security/ Moritz Muehlenhoff
August 27, 2024 https://www.debian.org/security/faq
Package : python3.11
CVE ID : CVE-2024-0397 CVE-2024-4032 CVE-2024-8088
Multiple security issues were discovered in Python, a high-level,
interactive, object-oriented language:
CVE-2024-0397
A race condition in the ssl module was found when accessing
CA certificates.
CVE-2024-4032
The ipaddress module contained incorrect information whether
some ipv4 and ipv6 address ranges are designated as globally
reachable or private.
CVE-2024-8088
Incorrect handling of path names in the zipfile module could
result in an infinite loop when processing a zip archive
(resulting in denial of service)
For the stable distribution (bookworm), these problems have been fixed in
version 3.11.2-6+deb12u3.
We recommend that you upgrade your python3.11 packages.
For the detailed security status of python3.11 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/python3.11
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: [email protected]
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmbNrEwACgkQEMKTtsN8
TjaT3w//VSRJYCGoVdKU8cdx82Q70C8qbMg044R/xeET4lwIGUP7iH5V71IVK3sj
xSo5PpaXczZZEwCF8qPLytZ3uj/QDzYDW20uCz/78TQBYhA/DpB2OGwBOuLCJ+oF
sNvA/tI9FQgqYJ8WsdmCTidjK4ftu5GQPHWHOWPf13ysUO9zfbH+Iwvr1g7UxhRu
s+1UUaTGjj0B5XFaeFeCIW5oUjSn4FGXjjGdVeWAG8tUtLtDZZ/65ZbNfxLG13Wy
5xHne8V1KHfAFiEUI+ugiQuHaI/l1CCIEMoIztSncv1MAjl/QlxwpVGKtkevhABZ
aR+i2wn2RR130BgOxrLigvy0TZIVnm51wpwncAleMGyseVRwghEeIsczOLry61Ut
rvkx4CuOsk6wArBpKVmty4n/1U0iGjKCmvvDEjxTioDhhIeZJtaT61v6UiiVZiy9
CoHvz3ZLoe8WApTroco8LIiCug4bo55OgPRE7CFB2Qua7sp+TuD/nYK6dF+XKwPM
Qpt7jGS7c5iD/GN8t1RbJusg568LjZWyXlqLZrFFSe2lkkud7UWHB8Z0kopi0l8x
VmAfDHgxycBZH9l2QIsYwu01xadmvWrOzddwa5C9aU9SvWaRKt3TItOSbqj5NsTo
ApzBr7cSPQsejvev5braLRcR89rJ1S2DLZ+dZZR9CT5hVZCZzFs=
=TwPS
-----END PGP SIGNATURE-----
Related news
Ubuntu Security Notice 7015-3 - USN-7015-1 fixed several vulnerabilities in Python. This update provides the corresponding updates for CVE-2023-27043 for python2.7 in Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS, and for python3.5 in Ubuntu 16.04 LTS. It was discovered that the Python email module incorrectly parsed email addresses that contain special characters. A remote attacker could possibly use this issue to bypass certain protection mechanisms. It was discovered that Python allowed excessive backtracking while parsing certain tarfile headers. A remote attacker could possibly use this issue to cause Python to consume resources, leading to a denial of service. It was discovered that the Python email module incorrectly quoted newlines for email headers. A remote attacker could possibly use this issue to perform header injection. It was discovered that the Python http.cookies module incorrectly handled parsing cookies that contained backslashes for quot...
Red Hat Security Advisory 2024-7417-03 - An update for python3 is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.6 Telecommunications Update Service.
Ubuntu Security Notice 7015-1 - It was discovered that the Python email module incorrectly parsed email addresses that contain special characters. A remote attacker could possibly use this issue to bypass certain protection mechanisms. It was discovered that Python allowed excessive backtracking while parsing certain tarfile headers. A remote attacker could possibly use this issue to cause Python to consume resources, leading to a denial of service.
Red Hat Security Advisory 2024-6030-03 - An update for python3 is now available for Red Hat Enterprise Linux 8.8 Extended Update Support.
Ubuntu Security Notice 6941-1 - It was discovered that the Python ipaddress module contained incorrect information about which IP address ranges were considered âprivateâ or âglobally reachableâ. This could possibly result in applications applying incorrect security policies.
Ubuntu Security Notice 6928-1 - It was discovered that the Python ssl module contained a memory race condition when handling the APIs to obtain the CA certificates and certificate store statistics. This could possibly result in applications obtaining wrong results, leading to various SSL issues. It was discovered that the Python ipaddress module contained incorrect information about which IP address ranges were considered "private" or "globally reachable". This could possibly result in applications applying incorrect security policies.
Ubuntu Security Notice 6928-1 - It was discovered that the Python ssl module contained a memory race condition when handling the APIs to obtain the CA certificates and certificate store statistics. This could possibly result in applications obtaining wrong results, leading to various SSL issues. It was discovered that the Python ipaddress module contained incorrect information about which IP address ranges were considered "private" or "globally reachable". This could possibly result in applications applying incorrect security policies.
Red Hat Security Advisory 2024-4779-03 - An update for python3 is now available for Red Hat Enterprise Linux 9.
Red Hat Security Advisory 2024-4766-03 - An update for python3 is now available for Red Hat Enterprise Linux 9.