Skip to content
OpenAdvisories
High ALAS2-2023-2317 5 CVEs

Important: python3 security update (Amazon Linux 2)

Published Oct 25, 2023 · Updated Apr 8, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-48566: An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possible in the accumulator variable in hmac.compare_digest. CVE-2022-48565: An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities. CVE-2022-48564: read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property List files in binary format. CVE-2020-27619: In Python3's Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP. CVE-2020-26116: A flaw was found in Python. The built-in modules httplib and http.client (included in Python 2 and Python 3, respectively) do not properly validate CRLF sequences in the HTTP request method, potentially allowing manipulation to the request by injecting additional HTTP headers. The highest threat from this vulnerability is to confidentiality and integrity.

Fixed packages 8

ReleasePackageFixed in
Amazon Linux · 2 python3 0:3.7.10-1.amzn2.0.1
Amazon Linux · 2 python3-debug 0:3.7.10-1.amzn2.0.1
Amazon Linux · 2 python3-debuginfo 0:3.7.10-1.amzn2.0.1
Amazon Linux · 2 python3-devel 0:3.7.10-1.amzn2.0.1
Amazon Linux · 2 python3-libs 0:3.7.10-1.amzn2.0.1
Amazon Linux · 2 python3-test 0:3.7.10-1.amzn2.0.1
Amazon Linux · 2 python3-tkinter 0:3.7.10-1.amzn2.0.1
Amazon Linux · 2 python3-tools 0:3.7.10-1.amzn2.0.1

Vulnerabilities 5

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-26116.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-27619.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-48564.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-48565.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-48566.html