Red Hat Security Advisory: rh-python38-python security update

Fixed packages 19

Vulnerabilities 8

• Critical 9.8
  CVE-2007-4559 Public exploit EPSS 27%

  Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allow…

  python3.4 python3.5 python2.7 python3.6 Ubuntu Azure Linux
  Aug 28, 2007
• High 7.5
  CVE-2022-40898

  pypa/wheel vulnerable to Regular Expression denial of service (ReDoS)

  An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli.

  python-pip python-wheel wheel wheel Debian Ubuntu Azure Linux PyPI
  Dec 22, 2022
• High 7.5
  CVE-2022-45061

  An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing …

  python3.4 python3.5 python2.7 python3.6 Debian Ubuntu Azure Linux Alpine
  Nov 9, 2022
• High 7.5
  CVE-2023-24329 Public exploit EPSS 20%

  An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by suppl…

  python3.4 python3.5 python2.7 python3.6 Debian Ubuntu Azure Linux
  Feb 17, 2023
• Medium 6.1
  CVE-2023-32681 Public exploit

  Unintended leak of Proxy-Authorization header in requests

  Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the `Proxy-Authorization` header…

  psf requests python-pip requests Debian Ubuntu Azure Linux PyPI
  May 26, 2023
• Medium 5.9
  CVE-2022-40897

  pypa/setuptools vulnerable to Regular Expression Denial of Service (ReDoS)

  Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.

  python3 python-pip setuptools setuptools Debian Ubuntu Azure Linux PyPI
  Dec 22, 2022
• Medium 4.8
  CVE-2023-23931

  Cipher.update_into can corrupt memory in pyca cryptography

  cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would a…

  pyca cryptography mitmproxy cryptography Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Feb 7, 2023
• Unscored —
  CVE-2023-40217

  An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. …

  python3.4 python3.5 python2.7 python3.6 Debian Ubuntu Azure Linux Alpine
  Aug 25, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=263261
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2144072
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2158559
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2165864
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2171817
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2173917
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2209469
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2235789
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_6793.json
• report
  https://access.redhat.com/security/cve/CVE-2007-4559
• advisory
  https://www.cve.org/CVERecord?id=CVE-2007-4559
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2007-4559
• report
  https://access.redhat.com/security/cve/CVE-2022-40897
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-40897
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-40897
• article
  https://pyup.io/vulnerabilities/CVE-2022-40897/52495/
• report
  https://access.redhat.com/security/cve/CVE-2022-40898
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-40898
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-40898
• advisory
  https://github.com/advisories/GHSA-qwmp-2cf2-g9g6
• report
  https://access.redhat.com/security/cve/CVE-2022-45061
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-45061
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-45061
• article
  https://github.com/python/cpython/issues/98433
• article
  https://python-security.readthedocs.io/vuln/slow-idna-large-strings.html
• report
  https://access.redhat.com/security/cve/CVE-2023-23931
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-23931
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-23931
• article
  https://github.com/pyca/cryptography/security/advisories/GHSA-w7pp-m8wf-vj6r
• report
  https://access.redhat.com/security/cve/CVE-2023-24329
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-24329
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-24329
• article
  https://pointernull.com/security/python-url-parse-problem.html
• report
  https://access.redhat.com/security/cve/CVE-2023-32681
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-32681
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-32681
• article
  https://github.com/psf/requests/security/advisories/GHSA-j8r2-6x86-q33q
• report
  https://access.redhat.com/security/cve/CVE-2023-40217