Medium ELSA-2023-6494 2 CVEs

Moderate: python3.11 security update (Oracle Linux 9)

Published Nov 11, 2023 · Updated Nov 11, 2023

Ecosystem: Oracle Linux

Summary

[3.11.5-1]
- Rebase to 3.11.5
- Security fixes for CVE-2023-40217 and CVE-2023-41105
Resolves: RHEL-3045, RHEL-3269

[3.11.4-3]
- Fix symlink handling in the fix for CVE-2023-24329
Resolves: rhbz#263261

[3.11.4-2]
- Security fix for CVE-2007-4559
Resolves: rhbz#263261

[3.11.4-1]
- Update to 3.11.4
- Security fix for CVE-2023-24329
Resolves: rhbz#2173917

Fixed packages 7

Release	Package	Fixed in
Oracle Linux · 9	python3.11	0:3.11.5-1.el9_3
Oracle Linux · 9	python3.11-debug	0:3.11.5-1.el9_3
Oracle Linux · 9	python3.11-devel	0:3.11.5-1.el9_3
Oracle Linux · 9	python3.11-idle	0:3.11.5-1.el9_3
Oracle Linux · 9	python3.11-libs	0:3.11.5-1.el9_3
Oracle Linux · 9	python3.11-test	0:3.11.5-1.el9_3
Oracle Linux · 9	python3.11-tkinter	0:3.11.5-1.el9_3

Vulnerabilities 2

Critical 9.8

CVE-2007-4559 Public exploit EPSS 27%

Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allow…

python3.4 python3.5 python2.7 python3.6 Ubuntu Azure Linux

Aug 28, 2007
Unscored —

CVE-2023-41105

An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.normpath(),…

python3.11 python3.11 Debian Ubuntu

Aug 23, 2023