Summary
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Security Fix(es):
* python: Virtual environment (venv) activation scripts don't quote paths (CVE-2024-9287)
* python: Unbounded memory buffering in SelectorSocketTransport.writelines() (CVE-2024-12254)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | python3.12 | 3.12.8-1.el8_10 |
| AlmaLinux · 8 | python3.12-debug | 3.12.8-1.el8_10 |
| AlmaLinux · 8 | python3.12-devel | 3.12.8-1.el8_10 |
| AlmaLinux · 8 | python3.12-idle | 3.12.8-1.el8_10 |
| AlmaLinux · 8 | python3.12-libs | 3.12.8-1.el8_10 |
| AlmaLinux · 8 | python3.12-rpm-macros | 3.12.8-1.el8_10 |
| AlmaLinux · 8 | python3.12-test | 3.12.8-1.el8_10 |
| AlmaLinux · 8 | python3.12-tkinter | 3.12.8-1.el8_10 |
Vulnerabilities 2
-
High 8.7
Unbounded memory buffering in SelectorSocketTransport.writelines()
Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not …
-
Medium 5.3
Virtual environment (venv) activation scripts don't quote paths
A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/…