Medium ELSA-2024-0114 2 CVEs

Moderate: python3 security update (Oracle Linux 8)

Published Jan 10, 2024 · Updated Jan 10, 2024

Ecosystem: Oracle Linux

Summary

[3.6.8-56.0.1.2]
- Add Oracle Linux distribution in platform.py [Orabug: 20812544]

[3.6.8-56.2]
- Security fix for CVE-2022-48560
Resolves: rhbz#2249755
- Security fix for CVE-2022-48564
Resolves: rhbz#2249750

Fixed packages 7

Release	Package	Fixed in
Oracle Linux · 8	platform-python	0:3.6.8-56.0.1.el8_9.2
Oracle Linux · 8	platform-python-debug	0:3.6.8-56.0.1.el8_9.2
Oracle Linux · 8	platform-python-devel	0:3.6.8-56.0.1.el8_9.2
Oracle Linux · 8	python3-idle	0:3.6.8-56.0.1.el8_9.2
Oracle Linux · 8	python3-libs	0:3.6.8-56.0.1.el8_9.2
Oracle Linux · 8	python3-test	0:3.6.8-56.0.1.el8_9.2
Oracle Linux · 8	python3-tkinter	0:3.6.8-56.0.1.el8_9.2

Vulnerabilities 2

Unscored —

CVE-2022-48560

A use-after-free exists in Python through 3.9 via heappushpop in heapq.

python3.4 python3.5 python2.7 python3.6 Debian Ubuntu Azure Linux

Aug 22, 2023
Unscored —

CVE-2022-48564

read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion whe…

python3.4 python3.5 python2.7 python3.6 Debian Ubuntu Azure Linux

Aug 22, 2023