RHSA-2024:3466 — Red Hat Security Advisory: python39:3.9 and python39-devel:3.9 security update

Fixed packages 102

Release	Package	Fixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream	mod_wsgi	0:4.7.1-7.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::appstream	numpy	0:1.19.4-3.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::appstream	numpy-debugsource	0:1.19.4-3.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-cffi	0:1.14.3-2.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-cffi-debugsource	0:1.14.3-2.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-chardet	0:3.0.4-19.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-cryptography	0:3.3.1-3.module+el8.10.0+21271+eccd1d86
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-cryptography-debugsource	0:3.3.1-3.module+el8.10.0+21271+eccd1d86
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-idna	0:2.10-4.module+el8.10.0+21815+bb024982
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-lxml	0:4.6.5-1.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-lxml-debugsource	0:4.6.5-1.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-ply	0:3.11-10.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-psutil	0:5.8.0-4.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-psutil-debugsource	0:5.8.0-4.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-psycopg2	0:2.8.6-3.module+el8.10.0+21142+453d2b75
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-psycopg2-debugsource	0:2.8.6-3.module+el8.10.0+21142+453d2b75
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-pycparser	0:2.20-3.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-PyMySQL	0:0.10.1-2.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-pysocks	0:1.7.1-4.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-requests	0:2.25.0-3.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-toml	0:0.10.1-5.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-urllib3	0:1.25.10-5.module+el8.10.0+20443+f0a692fe
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-wheel	1:0.35.1-4.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39	0:3.9.19-1.module+el8.10.0+21815+bb024982
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-cffi	0:1.14.3-2.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-cffi-debuginfo	0:1.14.3-2.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-chardet	0:3.0.4-19.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-cryptography	0:3.3.1-3.module+el8.10.0+21271+eccd1d86
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-cryptography-debuginfo	0:3.3.1-3.module+el8.10.0+21271+eccd1d86
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-debuginfo	0:3.9.19-1.module+el8.10.0+21815+bb024982
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-debugsource	0:3.9.19-1.module+el8.10.0+21815+bb024982
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-devel	0:3.9.19-1.module+el8.10.0+21815+bb024982
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-idle	0:3.9.19-1.module+el8.10.0+21815+bb024982
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-idna	0:2.10-4.module+el8.10.0+21815+bb024982
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-libs	0:3.9.19-1.module+el8.10.0+21815+bb024982
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-lxml	0:4.6.5-1.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-lxml-debuginfo	0:4.6.5-1.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-mod_wsgi	0:4.7.1-7.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-numpy	0:1.19.4-3.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-numpy-debuginfo	0:1.19.4-3.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-numpy-doc	0:1.19.4-3.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-numpy-f2py	0:1.19.4-3.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-pip	0:20.2.4-9.module+el8.10.0+21329+8d76b841
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-pip-wheel	0:20.2.4-9.module+el8.10.0+21329+8d76b841
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-ply	0:3.11-10.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-psutil	0:5.8.0-4.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-psutil-debuginfo	0:5.8.0-4.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-psycopg2	0:2.8.6-3.module+el8.10.0+21142+453d2b75
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-psycopg2-debuginfo	0:2.8.6-3.module+el8.10.0+21142+453d2b75
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-psycopg2-doc	0:2.8.6-3.module+el8.10.0+21142+453d2b75
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-psycopg2-tests	0:2.8.6-3.module+el8.10.0+21142+453d2b75
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-pycparser	0:2.20-3.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-PyMySQL	0:0.10.1-2.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-pysocks	0:1.7.1-4.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-pyyaml	0:5.4.1-1.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-pyyaml-debuginfo	0:5.4.1-1.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-requests	0:2.25.0-3.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-rpm-macros	0:3.9.19-1.module+el8.10.0+21815+bb024982
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-scipy	0:1.5.4-5.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-scipy-debuginfo	0:1.5.4-5.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-setuptools	0:50.3.2-5.module+el8.10.0+20345+671a55aa
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-setuptools-wheel	0:50.3.2-5.module+el8.10.0+20345+671a55aa
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-six	0:1.15.0-3.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-test	0:3.9.19-1.module+el8.10.0+21815+bb024982
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-tkinter	0:3.9.19-1.module+el8.10.0+21815+bb024982
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-toml	0:0.10.1-5.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-urllib3	0:1.25.10-5.module+el8.10.0+20443+f0a692fe
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-wheel	1:0.35.1-4.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-wheel-wheel	1:0.35.1-4.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::appstream	python3x-pip	0:20.2.4-9.module+el8.10.0+21329+8d76b841
Red Hat · RHEL 8 enterprise_linux:8::appstream	python3x-setuptools	0:50.3.2-5.module+el8.10.0+20345+671a55aa
Red Hat · RHEL 8 enterprise_linux:8::appstream	python3x-six	0:1.15.0-3.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::appstream	PyYAML	0:5.4.1-1.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::appstream	PyYAML-debugsource	0:5.4.1-1.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::appstream	scipy	0:1.5.4-5.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::appstream	scipy-debugsource	0:1.5.4-5.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::crb	Cython	0:0.29.21-5.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::crb	Cython-debugsource	0:0.29.21-5.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::crb	pybind11	0:2.7.1-1.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::crb	pytest	0:6.0.2-2.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::crb	python-attrs	0:20.3.0-2.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::crb	python-iniconfig	0:1.1.1-2.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::crb	python-more-itertools	0:8.5.0-2.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::crb	python-packaging	0:20.4-4.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::crb	python-pluggy	0:0.13.1-3.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::crb	python-py	0:1.10.0-1.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::crb	python-wcwidth	0:0.2.5-3.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::crb	python39-attrs	0:20.3.0-2.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::crb	python39-Cython	0:0.29.21-5.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::crb	python39-Cython-debuginfo	0:0.29.21-5.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::crb	python39-debug	0:3.9.19-1.module+el8.10.0+21815+bb024982
Red Hat · RHEL 8 enterprise_linux:8::crb	python39-iniconfig	0:1.1.1-2.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::crb	python39-more-itertools	0:8.5.0-2.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::crb	python39-packaging	0:20.4-4.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::crb	python39-pluggy	0:0.13.1-3.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::crb	python39-py	0:1.10.0-1.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::crb	python39-pybind11	0:2.7.1-1.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::crb	python39-pybind11-devel	0:2.7.1-1.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::crb	python39-pyparsing	0:2.4.7-5.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::crb	python39-pytest	0:6.0.2-2.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::crb	python39-wcwidth	0:0.2.5-3.module+el8.9.0+19644+d68f775d
Red Hat · RHEL 8 enterprise_linux:8::crb	python3x-pyparsing	0:2.4.7-5.module+el8.9.0+19644+d68f775d

Vulnerabilities 3

High 7.8

CVE-2023-6597

An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.1…

Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Alpine Wolfi

Mar 19, 2024
Medium 6.2

CVE-2024-0450

Quoted zip-bomb protection for zipfile

An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The zipfile module is vulnerable to “quoted-overlap” zip-bombs which exploit the zip format to create a zip-bomb with a high compressi…

Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Alpine Wolfi

Mar 19, 2024
Medium 6.2

CVE-2024-3651 Public exploit

Denial of Service via Quadratic Complexity in kjd/idna

A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a…

kjd kjd/idna katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi PyPI

Jul 7, 2024

References

article
https://access.redhat.com/security/updates/classification/#important
report
https://bugzilla.redhat.com/show_bug.cgi?id=2274779
report
https://bugzilla.redhat.com/show_bug.cgi?id=2276518
report
https://bugzilla.redhat.com/show_bug.cgi?id=2276525
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3466.json
report
https://access.redhat.com/security/cve/CVE-2023-6597
advisory
https://www.cve.org/CVERecord?id=CVE-2023-6597
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-6597
report
https://access.redhat.com/security/cve/CVE-2024-0450
advisory
https://www.cve.org/CVERecord?id=CVE-2024-0450
advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-0450
report
https://access.redhat.com/security/cve/CVE-2024-3651
advisory
https://www.cve.org/CVERecord?id=CVE-2024-3651
advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-3651

Red Hat Security Advisory: python39:3.9 and python39-devel:3.9 security update

Fixed packages 102

Vulnerabilities 3

An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.1…

Quoted zip-bomb protection for zipfile

Denial of Service via Quadratic Complexity in kjd/idna

References