Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-24329: An issue in the urllib.parse component of Python before v3.11 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters. CVE-2020-10735: A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int(text), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability.
Fixed packages 10
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | python-unversioned-command | 0:3.9.16-1.amzn2023.0.3 |
| Amazon Linux · 2023 | python3 | 0:3.9.16-1.amzn2023.0.3 |
| Amazon Linux · 2023 | python3-debug | 0:3.9.16-1.amzn2023.0.3 |
| Amazon Linux · 2023 | python3-devel | 0:3.9.16-1.amzn2023.0.3 |
| Amazon Linux · 2023 | python3-idle | 0:3.9.16-1.amzn2023.0.3 |
| Amazon Linux · 2023 | python3-libs | 0:3.9.16-1.amzn2023.0.3 |
| Amazon Linux · 2023 | python3-test | 0:3.9.16-1.amzn2023.0.3 |
| Amazon Linux · 2023 | python3-tkinter | 0:3.9.16-1.amzn2023.0.3 |
| Amazon Linux · 2023 | python3.9-debuginfo | 0:3.9.16-1.amzn2023.0.3 |
| Amazon Linux · 2023 | python3.9-debugsource | 0:3.9.16-1.amzn2023.0.3 |
Vulnerabilities 2
-
High 7.5
An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by suppl…
-
Medium 6.2
A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text")…