Skip to content
OpenAdvisories
Medium ALAS2-2022-1896 2 CVEs

Moderate: python3 security update (Amazon Linux 2)

Published Dec 1, 2022 · Updated Feb 11, 2025

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-28861: Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states "Warning: http.server is not recommended for production. It only implements basic security checks." CVE-2020-10735: A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability.

Fixed packages 8

ReleasePackageFixed in
Amazon Linux · 2 python3 0:3.7.15-1.amzn2.0.1
Amazon Linux · 2 python3-debug 0:3.7.15-1.amzn2.0.1
Amazon Linux · 2 python3-debuginfo 0:3.7.15-1.amzn2.0.1
Amazon Linux · 2 python3-devel 0:3.7.15-1.amzn2.0.1
Amazon Linux · 2 python3-libs 0:3.7.15-1.amzn2.0.1
Amazon Linux · 2 python3-test 0:3.7.15-1.amzn2.0.1
Amazon Linux · 2 python3-tkinter 0:3.7.15-1.amzn2.0.1
Amazon Linux · 2 python3-tools 0:3.7.15-1.amzn2.0.1

Vulnerabilities 2

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-10735.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-28861.html