ALAS2023-2023-082 — Important: python-bottle security update (Amazon Linux 2023)

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-31799: Bottle before 0.12.20 mishandles errors during early request binding. CVE-2022-3179: Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.4.2.

Fixed packages 1

Release	Package	Fixed in
Amazon Linux · 2023	python3-bottle	0:0.12.21-2.amzn2023.0.1

Vulnerabilities 2

Critical 9.8

CVE-2022-31799

Denial of service in bottle

Bottle before 0.12.20 mishandles errors during early request binding.

python-bottle python-bottle bottle py3-bottle Debian Ubuntu Alpine PyPI

May 29, 2022
High 7.1

CVE-2022-3179

Weak Password Requirements in ikus060/rdiffweb

Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.4.2.

ikus060 ikus060/rdiffweb rdiffweb PyPI

Sep 13, 2022

References

web
https://alas.aws.amazon.com/cve/html/CVE-2022-3179.html
web
https://alas.aws.amazon.com/cve/html/CVE-2022-31799.html

Important: python-bottle security update (Amazon Linux 2023)

Summary

Fixed packages 1

Vulnerabilities 2

Denial of service in bottle

Weak Password Requirements in ikus060/rdiffweb

References