Skip to content
OpenAdvisories
Medium ALSA-2023:7050 2 CVEs

Moderate: python38:3.8 and python38-devel:3.8 security update

Published Nov 14, 2023 · Updated Nov 2, 2026

Ecosystem: AlmaLinux

Summary

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* python: tarfile module directory traversal (CVE-2007-4559)
* python-requests: Unintended leak of Proxy-Authorization header (CVE-2023-32681)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Fixed packages 58

ReleasePackageFixed in
AlmaLinux · 8 python38 3.8.17-2.module_el8.9.0+3633+e453b53a
AlmaLinux · 8 python38-asn1crypto 1.2.0-3.module_el8.6.0+2778+cd494b30
AlmaLinux · 8 python38-atomicwrites 1.3.0-8.module_el8.6.0+2778+cd494b30
AlmaLinux · 8 python38-attrs 19.3.0-3.module_el8.6.0+2778+cd494b30
AlmaLinux · 8 python38-babel 2.7.0-11.module_el8.6.0+2778+cd494b30
AlmaLinux · 8 python38-cffi 1.13.2-3.module_el8.6.0+2778+cd494b30
AlmaLinux · 8 python38-cffi 1.13.2-3.module_el8.6.0+3163+f4472775
AlmaLinux · 8 python38-chardet 3.0.4-19.module_el8.6.0+2778+cd494b30
AlmaLinux · 8 python38-cryptography 2.8-3.module_el8.6.0+2778+cd494b30
AlmaLinux · 8 python38-cryptography 2.8-3.module_el8.6.0+3163+f4472775
AlmaLinux · 8 python38-Cython 0.29.14-4.module_el8.6.0+2778+cd494b30
AlmaLinux · 8 python38-Cython 0.29.14-4.module_el8.6.0+3163+f4472775
AlmaLinux · 8 python38-debug 3.8.17-2.module_el8.9.0+3633+e453b53a
AlmaLinux · 8 python38-devel 3.8.17-2.module_el8.9.0+3633+e453b53a
AlmaLinux · 8 python38-idle 3.8.17-2.module_el8.9.0+3633+e453b53a
AlmaLinux · 8 python38-idna 2.8-6.module_el8.6.0+2778+cd494b30
AlmaLinux · 8 python38-jinja2 2.11.3-1.module_el8.7.0+3344+99a6a656
AlmaLinux · 8 python38-libs 3.8.17-2.module_el8.9.0+3633+e453b53a
AlmaLinux · 8 python38-lxml 4.4.1-7.module_el8.6.0+2778+cd494b30
AlmaLinux · 8 python38-lxml 4.4.1-7.module_el8.6.0+3163+f4472775
AlmaLinux · 8 python38-markupsafe 1.1.1-6.module_el8.6.0+2778+cd494b30
AlmaLinux · 8 python38-markupsafe 1.1.1-6.module_el8.6.0+3163+f4472775
AlmaLinux · 8 python38-mod_wsgi 4.6.8-5.module_el8.9.0+3633+e453b53a
AlmaLinux · 8 python38-more-itertools 7.2.0-5.module_el8.6.0+2778+cd494b30
AlmaLinux · 8 python38-numpy 1.17.3-7.module_el8.9.0+3633+e453b53a
AlmaLinux · 8 python38-numpy-doc 1.17.3-7.module_el8.9.0+3633+e453b53a
AlmaLinux · 8 python38-numpy-f2py 1.17.3-7.module_el8.9.0+3633+e453b53a
AlmaLinux · 8 python38-packaging 19.2-3.module_el8.6.0+2778+cd494b30
AlmaLinux · 8 python38-pip 19.3.1-7.module_el8.9.0+3633+e453b53a
AlmaLinux · 8 python38-pip-wheel 19.3.1-7.module_el8.9.0+3633+e453b53a
AlmaLinux · 8 python38-pluggy 0.13.0-3.module_el8.6.0+2778+cd494b30
AlmaLinux · 8 python38-ply 3.11-10.module_el8.6.0+2778+cd494b30
AlmaLinux · 8 python38-psutil 5.6.4-4.module_el8.6.0+2778+cd494b30
AlmaLinux · 8 python38-psutil 5.6.4-4.module_el8.6.0+3163+f4472775
AlmaLinux · 8 python38-psycopg2 2.8.4-4.module_el8.7.0+3344+99a6a656
AlmaLinux · 8 python38-psycopg2-doc 2.8.4-4.module_el8.7.0+3344+99a6a656
AlmaLinux · 8 python38-psycopg2-tests 2.8.4-4.module_el8.7.0+3344+99a6a656
AlmaLinux · 8 python38-py 1.8.0-8.module_el8.6.0+2778+cd494b30
AlmaLinux · 8 python38-pycparser 2.19-3.module_el8.6.0+2778+cd494b30
AlmaLinux · 8 python38-PyMySQL 0.10.1-1.module_el8.6.0+2778+cd494b30
AlmaLinux · 8 python38-pyparsing 2.4.5-3.module_el8.6.0+2778+cd494b30
AlmaLinux · 8 python38-pysocks 1.7.1-4.module_el8.6.0+2778+cd494b30
AlmaLinux · 8 python38-pytest 4.6.6-3.module_el8.6.0+2778+cd494b30
AlmaLinux · 8 python38-pytz 2019.3-4.module_el8.9.0+3633+e453b53a
AlmaLinux · 8 python38-pyyaml 5.4.1-1.module_el8.6.0+2778+cd494b30
AlmaLinux · 8 python38-pyyaml 5.4.1-1.module_el8.6.0+3163+f4472775
AlmaLinux · 8 python38-requests 2.22.0-10.module_el8.9.0+3633+e453b53a
AlmaLinux · 8 python38-rpm-macros 3.8.17-2.module_el8.9.0+3633+e453b53a
AlmaLinux · 8 python38-scipy 1.3.1-5.module_el8.9.0+3633+e453b53a
AlmaLinux · 8 python38-setuptools 41.6.0-5.module_el8.6.0+2778+cd494b30
AlmaLinux · 8 python38-setuptools-wheel 41.6.0-5.module_el8.6.0+2778+cd494b30
AlmaLinux · 8 python38-six 1.12.0-10.module_el8.6.0+2778+cd494b30
AlmaLinux · 8 python38-test 3.8.17-2.module_el8.9.0+3633+e453b53a
AlmaLinux · 8 python38-tkinter 3.8.17-2.module_el8.9.0+3633+e453b53a
AlmaLinux · 8 python38-urllib3 1.25.7-5.module_el8.6.0+2778+cd494b30
AlmaLinux · 8 python38-wcwidth 0.1.7-16.module_el8.6.0+2778+cd494b30
AlmaLinux · 8 python38-wheel 0.33.6-6.module_el8.6.0+2778+cd494b30
AlmaLinux · 8 python38-wheel-wheel 0.33.6-6.module_el8.6.0+2778+cd494b30

Vulnerabilities 2

  • Critical 9.8
    CVE-2007-4559 Public exploit EPSS 27%

    Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allow…

    python3.4 python3.5 python2.7 python3.6 Ubuntu Azure Linux
  • Medium 6.1
    CVE-2023-32681 Public exploit

    Unintended leak of Proxy-Authorization header in requests

    Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the `Proxy-Authorization` header…

    psf requests python-pip requests Debian Ubuntu Azure Linux PyPI

References

  • report
    https://access.redhat.com/security/cve/CVE-2007-4559
  • report
    https://access.redhat.com/security/cve/CVE-2023-32681
  • report
    https://bugzilla.redhat.com/2209469
  • report
    https://bugzilla.redhat.com/2213594
  • report
    https://bugzilla.redhat.com/2213836
  • report
    https://bugzilla.redhat.com/2213847
  • report
    https://bugzilla.redhat.com/2217853
  • report
    https://bugzilla.redhat.com/2217862
  • report
    https://bugzilla.redhat.com/2218267
  • report
    https://bugzilla.redhat.com/2222717
  • report
    https://bugzilla.redhat.com/263261
  • advisory
    https://errata.almalinux.org/8/ALSA-2023-7050.html