Security update for python3

2024-09-2712:35:59

Google

osv.dev

python3

security

cve-2024-6923

cve-2024-5642

cve-2024-7592

cve-2024-6232

bug fixes

http.cookies module

openssl api

email header injection

tarfile headers

resource consumption

buffer overread

backtracking

dos

script attributes.

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.4

Confidence

Low

This update for python3 fixes the following issues:

CVE-2024-6923: Fixed uncontrolled CPU resource consumption when in http.cookies module (bsc#1228780).
CVE-2024-5642: Fixed buffer overread when NPN is used and invalid values are sent to the OpenSSL API (bsc#1227233).
CVE-2024-7592: Fixed Email header injection due to unquoted newlines (bsc#1229596).
CVE-2024-6232: excessive backtracking when parsing tarfile headers leads to ReDoS. (bsc#1230227)

Bug fixes:

%{profileopt} variable is set according to the variable %{do_profiling} (bsc#1227999).
Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378).
Remove %suse_update_desktop_file macro as it is not useful any more.