Red Hat Security Advisory: python3 security update

Fixed packages 14

Vulnerabilities 6

• Critical 9.8
  CVE-2007-4559 Public exploit EPSS 27%

  Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allow…

  python3.4 python3.5 python2.7 python3.6 Ubuntu Azure Linux
  Aug 28, 2007
• High 7.5
  CVE-2022-45061

  An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing …

  python3.4 python3.5 python2.7 python3.6 Debian Ubuntu Azure Linux Alpine
  Nov 9, 2022
• Medium 6.2
  CVE-2020-10735

  A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text")…

  python3.4 python3.5 python2.7 python3.6 Debian Ubuntu Wolfi
  Sep 9, 2022
• Medium 5.3
  CVE-2023-27043

  The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wro…

  python3.4 python3.5 python2.7 python3.6 Debian Ubuntu Azure Linux Alpine Wolfi
  Apr 18, 2023
• Unscored —
  CVE-2022-48560

  A use-after-free exists in Python through 3.9 via heappushpop in heapq.

  python3.4 python3.5 python2.7 python3.6 Debian Ubuntu Azure Linux
  Aug 22, 2023
• Unscored —
  CVE-2022-48564

  read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion whe…

  python3.4 python3.5 python2.7 python3.6 Debian Ubuntu Azure Linux
  Aug 22, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=263261
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1834423
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2144072
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2196183
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2249750
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2249755
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0430.json
• report
  https://access.redhat.com/security/cve/CVE-2007-4559
• advisory
  https://www.cve.org/CVERecord?id=CVE-2007-4559
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2007-4559
• report
  https://access.redhat.com/security/cve/CVE-2020-10735
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-10735
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-10735
• article
  https://github.com/python/cpython/pull/96499
• report
  https://access.redhat.com/security/cve/CVE-2022-45061
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-45061
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-45061
• article
  https://github.com/python/cpython/issues/98433
• article
  https://python-security.readthedocs.io/vuln/slow-idna-large-strings.html
• report
  https://access.redhat.com/security/cve/CVE-2022-48560
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-48560
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-48560
• article
  https://bugs.python.org/issue39421
• article
  https://github.com/python/cpython/issues/83602
• report
  https://access.redhat.com/security/cve/CVE-2022-48564
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-48564
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-48564
• article
  https://bugs.python.org/issue42103
• article
  https://github.com/python/cpython/issues/86269
• report
  https://access.redhat.com/security/cve/CVE-2023-27043
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-27043
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-27043
• article
  https://access.redhat.com/articles/7051467