Updated python3, python packages fix security vulnerabilities

2024-03-2806:52:55

Gentoo Foundation

advisories.mageia.org

python3

security vulnerabilities

tempfile.temporarydirectory

symlink

zipfile

quoted-overlap

zip-bombs

cpython

high compression ratio

cve-2023-6597

cve-2024-0450

unix

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

6.6 Medium

AI Score

Confidence

Low

0.0005 Low

EPSS

Percentile

17.1%

JSON

The tempfile.TemporaryDirectory class would dereference symlinks during cleanup of permissions-related errors. This means users which can run privileged programs are potentially able to modify permissions of files referenced by symlinks in some circumstances. (CVE-2023-6597) The zipfile module is vulnerable to “quoted-overlap” zip-bombs which exploit the zip format to create a zip-bomb with a high compression ratio. The fixed versions of CPython makes the zipfile module reject zip archives which overlap entries in the archive. (CVE-2024-0450)

OSVersionArchitecturePackageVersionFilename
Mageia9noarchpython3< 3.10.11-1.2python3-3.10.11-1.2.mga9
Mageia9noarchpython< 2.7.18-15.2python-2.7.18-15.2.mga9