Описание
Security update for python3
This update for python3 fixes the following issues:
- CVE-2023-40217: Fixed bypass TLS handshake on closed sockets (bsc#1214692).
- CVE-2023-6597: Fixed symlink bug in cleanup (bsc#1219666).
Список пакетов
Image SLES12-SP5-Azure-BYOS
Image SLES12-SP5-Azure-Basic-On-Demand
Image SLES12-SP5-Azure-HPC-BYOS
Image SLES12-SP5-Azure-HPC-On-Demand
Image SLES12-SP5-Azure-SAP-BYOS
Image SLES12-SP5-Azure-SAP-On-Demand
Image SLES12-SP5-Azure-Standard-On-Demand
Image SLES12-SP5-EC2-BYOS
Image SLES12-SP5-EC2-ECS-On-Demand
Image SLES12-SP5-EC2-On-Demand
Image SLES12-SP5-EC2-SAP-BYOS
Image SLES12-SP5-EC2-SAP-On-Demand
Image SLES12-SP5-GCE-BYOS
Image SLES12-SP5-GCE-On-Demand
Image SLES12-SP5-GCE-SAP-BYOS
Image SLES12-SP5-GCE-SAP-On-Demand
Image SLES12-SP5-SAP-Azure-LI-BYOS-Production
Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production
SUSE Linux Enterprise Module for Web and Scripting 12
SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise Server for SAP Applications 12 SP5
SUSE Linux Enterprise Software Development Kit 12 SP5
Ссылки
- Link for SUSE-SU-2024:0785-1
- E-Mail link for SUSE-SU-2024:0785-1
- SUSE Security Ratings
- SUSE Bug 1214692
- SUSE Bug 1219666
- SUSE CVE CVE-2023-40217 page
- SUSE CVE CVE-2023-6597 page
Описание
An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If a TLS server-side socket is created, receives data into the socket buffer, and then is closed quickly, there is a brief window where the SSLSocket instance will detect the socket as "not connected" and won't initiate a handshake, but buffered data will still be readable from the socket buffer. This data will not be authenticated if the server-side TLS peer is expecting client certificate authentication, and is indistinguishable from valid TLS stream data. Data is limited in size to the amount that will fit in the buffer. (The TLS connection cannot directly be used for data exfiltration because the vulnerable code path requires that the connection be closed on initialization of the SSLSocket.)
Затронутые продукты
Ссылки
- CVE-2023-40217
- SUSE Bug 1214692
- SUSE Bug 1217524
- SUSE Bug 1218319
- SUSE Bug 1218476
- SUSE Bug 1218965
- SUSE Bug 1219472
- SUSE Bug 1219713
- SUSE Bug 1221582
- SUSE Bug 1224883
Описание
An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference symlinks during cleanup of permissions-related errors. This means users which can run privileged programs are potentially able to modify permissions of files referenced by symlinks in some circumstances.
Затронутые продукты
Ссылки
- CVE-2023-6597
- SUSE Bug 1219666
- SUSE Bug 1221854
- SUSE Bug 1224879
- SUSE Bug 1225185