Summary
mod_wsgi
numpy
python39
[3.9.25-2]
- Add explicit BR: libxcrypt-devel
- Properly apply exported CFLAGS for dtrace/systemtap builds
- Update to Python 3.9.25
- Move _sysconfigdata_d_linux*.py to the debug subpackage
- Fedora contributions by:
Bjorn Esser <besser82@fedoraproject.org>
Charalampos Stratakis <cstratak@redhat.com>
Karolina Surma <ksurma@redhat.com>
Tomas Orsava <torsava@redhat.com>
Tomas Hrnciar <thrnciar@redhat.com>
Resolves: RHEL-128539
python3x-pip
python3x-setuptools
python3x-six
python-cffi
python-chardet
python-cryptography
python-idna
python-lxml
python-ply
python-psutil
python-psycopg2
python-pycparser
python-PyMySQL
python-pysocks
python-requests
python-toml
python-urllib3
python-wheel
PyYAML
scipy
Cython
pybind11
pytest
python3x-pyparsing
python-attrs
python-iniconfig
python-more-itertools
python-packaging
python-pluggy
python-py
python-wcwidth
Fixed packages 49
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | python39 | 0:3.9.25-2.module+el8.10.0+90733+27f37730 |
| Oracle Linux · 8 | python39-attrs | 0:20.3.0-2.module+el8.9.0+90016+9c2d6573 |
| Oracle Linux · 8 | python39-cffi | 0:1.14.3-2.module+el8.9.0+90016+9c2d6573 |
| Oracle Linux · 8 | python39-chardet | 0:3.0.4-19.module+el8.9.0+90016+9c2d6573 |
| Oracle Linux · 8 | python39-cryptography | 0:3.3.1-3.0.1.module+el8.10.0+90269+2fa22b99 |
| Oracle Linux · 8 | python39-Cython | 0:0.29.21-5.module+el8.9.0+90016+9c2d6573 |
| Oracle Linux · 8 | python39-debug | 0:3.9.25-2.module+el8.10.0+90733+27f37730 |
| Oracle Linux · 8 | python39-devel | 0:3.9.25-2.module+el8.10.0+90733+27f37730 |
| Oracle Linux · 8 | python39-idle | 0:3.9.25-2.module+el8.10.0+90733+27f37730 |
| Oracle Linux · 8 | python39-idna | 0:2.10-4.module+el8.10.0+90341+71ca88f4 |
| Oracle Linux · 8 | python39-iniconfig | 0:1.1.1-2.module+el8.9.0+90016+9c2d6573 |
| Oracle Linux · 8 | python39-libs | 0:3.9.25-2.module+el8.10.0+90733+27f37730 |
| Oracle Linux · 8 | python39-lxml | 0:4.6.5-1.module+el8.9.0+90016+9c2d6573 |
| Oracle Linux · 8 | python39-mod_wsgi | 0:4.7.1-7.module+el8.10.0+90647+49247197.1 |
| Oracle Linux · 8 | python39-more-itertools | 0:8.5.0-2.module+el8.9.0+90016+9c2d6573 |
| Oracle Linux · 8 | python39-numpy | 0:1.19.4-3.module+el8.9.0+90016+9c2d6573 |
| Oracle Linux · 8 | python39-numpy-doc | 0:1.19.4-3.module+el8.9.0+90016+9c2d6573 |
| Oracle Linux · 8 | python39-numpy-f2py | 0:1.19.4-3.module+el8.9.0+90016+9c2d6573 |
| Oracle Linux · 8 | python39-packaging | 0:20.4-4.module+el8.9.0+90016+9c2d6573 |
| Oracle Linux · 8 | python39-pip | 0:20.2.4-9.module+el8.10.0+90269+2fa22b99 |
| Oracle Linux · 8 | python39-pip-wheel | 0:20.2.4-9.module+el8.10.0+90269+2fa22b99 |
| Oracle Linux · 8 | python39-pluggy | 0:0.13.1-3.module+el8.9.0+90016+9c2d6573 |
| Oracle Linux · 8 | python39-ply | 0:3.11-10.module+el8.9.0+90016+9c2d6573 |
| Oracle Linux · 8 | python39-psutil | 0:5.8.0-4.module+el8.9.0+90016+9c2d6573 |
| Oracle Linux · 8 | python39-psycopg2 | 0:2.8.6-3.module+el8.10.0+90269+2fa22b99 |
| Oracle Linux · 8 | python39-psycopg2-doc | 0:2.8.6-3.module+el8.10.0+90269+2fa22b99 |
| Oracle Linux · 8 | python39-psycopg2-tests | 0:2.8.6-3.module+el8.10.0+90269+2fa22b99 |
| Oracle Linux · 8 | python39-py | 0:1.10.0-1.module+el8.9.0+90016+9c2d6573 |
| Oracle Linux · 8 | python39-pybind11 | 0:2.7.1-1.module+el8.9.0+90016+9c2d6573 |
| Oracle Linux · 8 | python39-pybind11-devel | 0:2.7.1-1.module+el8.9.0+90016+9c2d6573 |
| Oracle Linux · 8 | python39-pycparser | 0:2.20-3.module+el8.9.0+90016+9c2d6573 |
| Oracle Linux · 8 | python39-PyMySQL | 0:0.10.1-2.module+el8.9.0+90016+9c2d6573 |
| Oracle Linux · 8 | python39-pyparsing | 0:2.4.7-5.module+el8.9.0+90016+9c2d6573 |
| Oracle Linux · 8 | python39-pysocks | 0:1.7.1-4.module+el8.9.0+90016+9c2d6573 |
| Oracle Linux · 8 | python39-pytest | 0:6.0.2-2.module+el8.9.0+90016+9c2d6573 |
| Oracle Linux · 8 | python39-pyyaml | 0:5.4.1-1.module+el8.9.0+90016+9c2d6573 |
| Oracle Linux · 8 | python39-requests | 0:2.25.0-3.module+el8.9.0+90016+9c2d6573 |
| Oracle Linux · 8 | python39-rpm-macros | 0:3.9.25-2.module+el8.10.0+90733+27f37730 |
| Oracle Linux · 8 | python39-scipy | 0:1.5.4-5.module+el8.9.0+90016+9c2d6573 |
| Oracle Linux · 8 | python39-setuptools | 0:50.3.2-7.module+el8.10.0+90647+49247197 |
| Oracle Linux · 8 | python39-setuptools-wheel | 0:50.3.2-7.module+el8.10.0+90647+49247197 |
| Oracle Linux · 8 | python39-six | 0:1.15.0-3.module+el8.9.0+90016+9c2d6573 |
| Oracle Linux · 8 | python39-test | 0:3.9.25-2.module+el8.10.0+90733+27f37730 |
| Oracle Linux · 8 | python39-tkinter | 0:3.9.25-2.module+el8.10.0+90733+27f37730 |
| Oracle Linux · 8 | python39-toml | 0:0.10.1-5.module+el8.9.0+90016+9c2d6573 |
| Oracle Linux · 8 | python39-urllib3 | 0:1.25.10-5.module+el8.10.0+90269+2fa22b99 |
| Oracle Linux · 8 | python39-wcwidth | 0:0.2.5-3.module+el8.9.0+90016+9c2d6573 |
| Oracle Linux · 8 | python39-wheel | 1:0.35.1-4.module+el8.9.0+90016+9c2d6573 |
| Oracle Linux · 8 | python39-wheel-wheel | 1:0.35.1-4.module+el8.9.0+90016+9c2d6573 |
Vulnerabilities 12
-
Critical 9.4CVE-2025-4517 Public exploit
Arbitrary writes via tarfile realpath overflow
Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data". You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() usin…
-
High 7.5CVE-2025-4138 Public exploit
Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory
Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives u…
-
High 7.5
Extraction filter bypass for linking outside extraction directory
Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives u…
-
High 7.5
Tarfile extracts filtered members when errorlevel=0
When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior is that any filtered members would be skipped and not extracted. However the actual behavior of TarFile.errorlevel = 0 in affected versions is that the member would still…
-
Medium 6.5
Buffer overread when using an empty list with SSLContext.set_npn_protocols()
CPython 3.9 and earlier doesn't disallow configuring an empty list ("[]") for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vu…
-
Medium 6.3
Improper validation of IPv6 and IPvFuture addresses
The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one U…
-
Medium 6.3
URL parser allowed square brackets in domain names
The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture…
-
Medium 5.9
Use-after-free in "unicode_escape" decoder with error handler
There is an issue in CPython when using `bytes.decode("unicode_escape", error="ignore|replace")`. If you are not using the "unicode_escape" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handle…
-
Medium 5.3
Virtual environment (venv) activation scripts don't quote paths
A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/…
-
Medium 4.3
HTMLParser quadratic complexity when processing malformed inputs
The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service.
-
Medium 4.3
ZIP64 End of Central Directory (EOCD) Locator record offset not checked
The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be assumed to be the previous record in the ZIP a…
-
Low 1.8
Quadratic complexity in os.path.expandvars() with user-controlled template
If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.