Summary
Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic data types, and dynamic typing. The python27 packages provide a stable release of Python 2.7 with a number of additional utilities and database connectors for MySQL and PostgreSQL.
Security Fix(es):
* pypa-setuptools: Regular Expression Denial of Service (ReDoS) in package_index.py (CVE-2022-40897)
* python: use after free in heappushpop() of heapq module (CVE-2022-48560)
* python: XML External Entity in XML processing plistlib module (CVE-2022-48565)
* python-urllib3: Cookie request header isn't stripped during cross-origin redirects (CVE-2023-43804)
* jinja2: HTML attribute injection when passing user input as keys to xmlattr filter (CVE-2024-22195)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 8.10 Release Notes linked from the References section.
Fixed packages 52
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 8 | babel | 0:2.5.1-10.module+el8.9.0+1531+a18208f5 |
| Rocky Linux · 8 | Cython | 0:0.28.1-7.module+el8.9.0+1531+a18208f5 |
| Rocky Linux · 8 | numpy | 1:1.14.2-16.module+el8.9.0+1531+a18208f5 |
| Rocky Linux · 8 | pytest | 0:3.4.2-13.module+el8.9.0+1531+a18208f5 |
| Rocky Linux · 8 | python-attrs | 0:17.4.0-10.module+el8.9.0+1531+a18208f5 |
| Rocky Linux · 8 | python-backports | 0:1.0-16.module+el8.9.0+1531+a18208f5 |
| Rocky Linux · 8 | python-backports-ssl_match_hostname | 0:3.5.0.1-12.module+el8.9.0+1531+a18208f5 |
| Rocky Linux · 8 | python-chardet | 0:3.0.4-10.module+el8.9.0+1531+a18208f5 |
| Rocky Linux · 8 | python-coverage | 0:4.5.1-5.module+el8.10.0+1817+0b01df83 |
| Rocky Linux · 8 | python-dns | 0:1.15.0-10.module+el8.9.0+1531+a18208f5 |
| Rocky Linux · 8 | python-docs | 0:2.7.16-2.module+el8.9.0+1531+a18208f5 |
| Rocky Linux · 8 | python-docutils | 0:0.14-12.module+el8.10.0+1592+61442852 |
| Rocky Linux · 8 | python-docutils | 0:0.14-12.module+el8.10.0+1910+234ad790 |
| Rocky Linux · 8 | python-docutils | 0:0.14-12.module+el8.9.0+1531+a18208f5 |
| Rocky Linux · 8 | python-funcsigs | 0:1.0.2-13.module+el8.9.0+1531+a18208f5 |
| Rocky Linux · 8 | python-idna | 0:2.5-7.module+el8.9.0+1531+a18208f5 |
| Rocky Linux · 8 | python-ipaddress | 0:1.0.18-6.module+el8.9.0+1531+a18208f5 |
| Rocky Linux · 8 | python-jinja2 | 0:2.10-10.module+el8.10.0+1813+4b021305 |
| Rocky Linux · 8 | python-lxml | 0:4.2.3-6.module+el8.9.0+1531+a18208f5 |
| Rocky Linux · 8 | python-markupsafe | 0:0.23-19.module+el8.9.0+1531+a18208f5 |
| Rocky Linux · 8 | python-mock | 0:2.0.0-13.module+el8.9.0+1531+a18208f5 |
| Rocky Linux · 8 | python-nose | 0:1.3.7-31.module+el8.10.0+1592+61442852 |
| Rocky Linux · 8 | python-nose | 0:1.3.7-31.module+el8.10.0+1910+234ad790 |
| Rocky Linux · 8 | python-nose | 0:1.3.7-31.module+el8.9.0+1531+a18208f5 |
| Rocky Linux · 8 | python-pluggy | 0:0.6.0-8.module+el8.9.0+1531+a18208f5 |
| Rocky Linux · 8 | python-psycopg2 | 0:2.7.5-8.module+el8.10.0+1817+0b01df83 |
| Rocky Linux · 8 | python-py | 0:1.5.3-6.module+el8.9.0+1531+a18208f5 |
| Rocky Linux · 8 | python-pygments | 0:2.2.0-22.module+el8.10.0+1592+61442852 |
| Rocky Linux · 8 | python-pygments | 0:2.2.0-22.module+el8.10.0+1910+234ad790 |
| Rocky Linux · 8 | python-pygments | 0:2.2.0-22.module+el8.9.0+1531+a18208f5 |
| Rocky Linux · 8 | python-pymongo | 0:3.7.0-1.module+el8.10.0+1592+61442852 |
| Rocky Linux · 8 | python-pymongo | 0:3.7.0-1.module+el8.10.0+1910+234ad790 |
| Rocky Linux · 8 | python-pymongo | 0:3.7.0-1.module+el8.9.0+1531+a18208f5 |
| Rocky Linux · 8 | python-PyMySQL | 0:0.8.0-10.module+el8.9.0+1531+a18208f5 |
| Rocky Linux · 8 | python-pysocks | 0:1.6.8-6.module+el8.9.0+1531+a18208f5 |
| Rocky Linux · 8 | python-pytest-mock | 0:1.9.0-4.module+el8.9.0+1531+a18208f5 |
| Rocky Linux · 8 | python-requests | 0:2.20.0-4.module+el8.10.0+1817+0b01df83 |
| Rocky Linux · 8 | python-setuptools_scm | 0:1.15.7-6.module+el8.9.0+1531+a18208f5 |
| Rocky Linux · 8 | python-sqlalchemy | 0:1.3.2-2.module+el8.9.0+1531+a18208f5 |
| Rocky Linux · 8 | python-urllib3 | 0:1.24.2-4.module+el8.10.0+1813+4b021305 |
| Rocky Linux · 8 | python-virtualenv | 0:15.1.0-22.module+el8.10.0+1592+61442852 |
| Rocky Linux · 8 | python-wheel | 1:0.31.1-3.module+el8.10.0+1592+61442852 |
| Rocky Linux · 8 | python-wheel | 1:0.31.1-3.module+el8.10.0+1910+234ad790 |
| Rocky Linux · 8 | python-wheel | 1:0.31.1-3.module+el8.9.0+1531+a18208f5 |
| Rocky Linux · 8 | python2 | 0:2.7.18-17.module+el8.10.0+1813+4b021305.rocky.0.2 |
| Rocky Linux · 8 | python2-pip | 0:9.0.3-19.module+el8.9.0+1531+a18208f5 |
| Rocky Linux · 8 | python2-rpm-macros | 0:3-38.module+el8.9.0+1531+a18208f5 |
| Rocky Linux · 8 | python2-setuptools | 0:39.0.1-14.module+el8.10.0+1813+4b021305 |
| Rocky Linux · 8 | python2-six | 0:1.11.0-6.module+el8.9.0+1531+a18208f5 |
| Rocky Linux · 8 | pytz | 0:2017.2-13.module+el8.10.0+1817+0b01df83 |
| Rocky Linux · 8 | PyYAML | 0:3.12-16.module+el8.9.0+1531+a18208f5 |
| Rocky Linux · 8 | scipy | 0:1.0.0-22.module+el8.10.0+1817+0b01df83 |
Vulnerabilities 5
-
Medium 5.9
pypa/setuptools vulnerable to Regular Expression Denial of Service (ReDoS)
Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
-
Medium 5.9CVE-2023-43804 Public exploit
`Cookie` HTTP header isn't stripped on cross-origin redirects
urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `C…
-
Medium 5.4
Jinja vulnerable to Cross-Site Scripting (XSS)
Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). …
-
Unscored —
A use-after-free exists in Python through 3.9 via heappushpop in heapq.
-
Unscored —CVE-2022-48565 Public exploit
An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity…