Summary
[3.9.21-1]
- Update to 3.9.21
- Security fix for CVE-2024-11168 and CVE-2024-9287
Resolves: RHEL-64888
Resolves: RHEL-67259
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | python-unversioned-command | 0:3.9.21-1.el9_5 |
| Oracle Linux · 9 | python3 | 0:3.9.21-1.el9_5 |
| Oracle Linux · 9 | python3-debug | 0:3.9.21-1.el9_5 |
| Oracle Linux · 9 | python3-devel | 0:3.9.21-1.el9_5 |
| Oracle Linux · 9 | python3-idle | 0:3.9.21-1.el9_5 |
| Oracle Linux · 9 | python3-libs | 0:3.9.21-1.el9_5 |
| Oracle Linux · 9 | python3-test | 0:3.9.21-1.el9_5 |
| Oracle Linux · 9 | python3-tkinter | 0:3.9.21-1.el9_5 |
Vulnerabilities 2
-
Medium 6.3
Improper validation of IPv6 and IPvFuture addresses
The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one U…
-
Medium 5.3
Virtual environment (venv) activation scripts don't quote paths
A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/…