Advisory ROSA-SA-2023-2202

Software: python 3.6.8
OS: rosa-server79

package_evr_string: python-3.6.8-19.res7

CVE-ID: CVE-2023-24329
BDU-ID: None
CVE-Crit: HIGH
CVE-DESC.: A problem in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blacklisting methods by providing a URL that starts with empty characters.
CVE-STATUS: Fixed
CVE-REV: Run the yum update python command to close it

CVE-ID: CVE-2020-14422
BDU-ID: 2021-00757
CVE-Crit: HIGH
CVE-DESC.: An implementation vulnerability in the IPv4Interface and IPv6Interface classes of the Lib/ipaddress.py module of the Python programming language interpreter is associated with uncontrolled resource consumption. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service
CVE-STATUS: Fixed
CVE-REV: To close, run the yum update python command

CVE-ID: CVE-2019-20907
BDU-ID: None
CVE-Crit: HIGH
CVE-DESC.: In Lib/tarfile.py in Python before 3.8.3, an attacker could create a TAR archive leading to an infinite loop when opened with tarfile.open because _proc_pax lacks header validation.
CVE-STATUS: Fixed
CVE-REV: Run the yum update python command to close it