ALT-PU-2025-2199

Низкий

ALT-PU-2025-2199: package python3-module-tqdm update to version 4.66.5-alt1.p10.1

Источник

errata.altlinux.org

Дата публикации

03.02.2025

Дата обновления

03.02.2025

Устраненные уязвимости

ALT Linux branch p10

ALT Server

ALT Virtualization Server

ALT Workstation

ALT Workstation K

ALT Education

Simply Linux

Starterkit

ALT Container

Описание

This update upgrades python3-module-tqdm to version 4.66.5-alt1.p10.1.

Устраненные уязвимости1

CVE-2024-34062

Средний 4.8

Дата публикации: 03.05.2024

CWE-74

tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments (e.g. --delim, --buf-size, --manpath) are passed through python's eval, allowing arbitrary code execution. This issue is only locally exploitable and had been addressed in release version 4.66.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS 3.1

Средний 4.8

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Attack vector: Local
Complexity: Low
Privileges: Low
User interaction: Required
Scope: Unchanged
Confidentiality: Low
Integrity: Low
Availability: Low

Ссылки

CVE-2024-34062 https://nvd.nist.gov/vuln/detail/CVE-2024-34062

Ссылки1

ALT-PU-2025-2199 https://errata.altlinux.org/ALT-PU-2025-2199

Связанные уязвимости

CVE-2024-34062

CVSS3: 4.8

ubuntu

больше 2 лет назад

tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`, `--manpath`) are passed through python's `eval`, allowing arbitrary code execution. This issue is only locally exploitable and had been addressed in release version 4.66.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.