Red Hat Security Advisory: python3.9:3.9.21 security update

Fixed packages 17

Vulnerabilities 4

• High 7.5
  CVE-2024-7592

  Quadratic complexity parsing cookies with backslashes

  There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic compl…

  Python Software Foundation CPython tensorflow python3.4 Debian Ubuntu Azure Linux Alpine Wolfi
  Aug 19, 2024
• High 7.4
  CVE-2024-0397

  Memory race condition in ssl.SSLContext certificate store methods

  A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at the same time as certificates…

  Python Software Foundation CPython python3.4 python2.7 Debian Ubuntu Azure Linux
  Jun 17, 2024
• Medium 6.3
  CVE-2024-11168

  Improper validation of IPv6 and IPvFuture addresses

  The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one U…

  Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Wolfi
  Nov 12, 2024
• Medium 5.3
  CVE-2024-9287

  Virtual environment (venv) activation scripts don't quote paths

  A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/…

  Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Alpine Wolfi
  Oct 22, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2321440
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2325776
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10983.json
• report
  https://access.redhat.com/security/cve/CVE-2024-0397
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2301891
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-0397
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-0397
• article
  https://mail.python.org/archives/list/security-announce@python.org/thread/BMAK5BCGKYWNJOACVUSLUF6SFGBIM4VP/
• report
  https://access.redhat.com/security/cve/CVE-2024-7592
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2305879
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-7592
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-7592
• article
  https://github.com/python/cpython/issues/123067
• article
  https://github.com/python/cpython/pull/123075
• article
  https://mail.python.org/archives/list/security-announce@python.org/thread/HXJAAAALNUNGCQUS2W7WR6GFIZIHFOOK/
• report
  https://access.redhat.com/security/cve/CVE-2024-9287
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-9287
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-9287
• article
  https://github.com/python/cpython/issues/124651
• article
  https://github.com/python/cpython/pull/124712
• article
  https://mail.python.org/archives/list/security-announce@python.org/thread/RSPJ2B5JL22FG3TKUJ7D7DQ4N5JRRBZL/
• report
  https://access.redhat.com/security/cve/CVE-2024-11168
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-11168
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-11168
• article
  https://github.com/python/cpython/commit/29f348e232e82938ba2165843c448c2b291504c5
• article
  https://github.com/python/cpython/commit/b2171a2fd41416cf68afd67460578631d755a550
• article
  https://github.com/python/cpython/issues/103848
• article
  https://github.com/python/cpython/pull/103849
• article
  https://mail.python.org/archives/list/security-announce@python.org/thread/XPWB6XVZ5G5KGEI63M4AWLIEUF5BPH4T/