Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2024:1774-1

Опубликовано: 24 мая 2024
Источник: suse-cvrf

Описание

Security update for python3

This update for python3 fixes the following issues:

  • CVE-2023-52425: Fixed backport so it uses features sniffing, not just comparing version number (bsc#1219559).
  • CVE-2024-0450: Fixed detecting the vulnerability of 'quoted-overlap' zipbomb (bsc#1221854).

Список пакетов

Image SLES15-SP2-SAP-Azure-LI-BYOS-Production
libpython3_6m1_0-3.6.15-150000.3.147.1
python3-3.6.15-150000.3.147.1
python3-base-3.6.15-150000.3.147.1
python3-curses-3.6.15-150000.3.147.1
Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production
libpython3_6m1_0-3.6.15-150000.3.147.1
python3-3.6.15-150000.3.147.1
python3-base-3.6.15-150000.3.147.1
python3-curses-3.6.15-150000.3.147.1
SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS
libpython3_6m1_0-3.6.15-150000.3.147.1
python3-3.6.15-150000.3.147.1
python3-base-3.6.15-150000.3.147.1
python3-curses-3.6.15-150000.3.147.1
python3-dbm-3.6.15-150000.3.147.1
python3-devel-3.6.15-150000.3.147.1
python3-idle-3.6.15-150000.3.147.1
python3-tk-3.6.15-150000.3.147.1
python3-tools-3.6.15-150000.3.147.1
SUSE Linux Enterprise Micro 5.1
libpython3_6m1_0-3.6.15-150000.3.147.1
python3-3.6.15-150000.3.147.1
python3-base-3.6.15-150000.3.147.1
SUSE Linux Enterprise Server 15 SP2-LTSS
libpython3_6m1_0-3.6.15-150000.3.147.1
python3-3.6.15-150000.3.147.1
python3-base-3.6.15-150000.3.147.1
python3-curses-3.6.15-150000.3.147.1
python3-dbm-3.6.15-150000.3.147.1
python3-devel-3.6.15-150000.3.147.1
python3-idle-3.6.15-150000.3.147.1
python3-tk-3.6.15-150000.3.147.1
python3-tools-3.6.15-150000.3.147.1
SUSE Linux Enterprise Server for SAP Applications 15 SP2
libpython3_6m1_0-3.6.15-150000.3.147.1
python3-3.6.15-150000.3.147.1
python3-base-3.6.15-150000.3.147.1
python3-curses-3.6.15-150000.3.147.1
python3-dbm-3.6.15-150000.3.147.1
python3-devel-3.6.15-150000.3.147.1
python3-idle-3.6.15-150000.3.147.1
python3-tk-3.6.15-150000.3.147.1
python3-tools-3.6.15-150000.3.147.1

Ссылки

Описание

libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.

Затронутые продукты
Image SLES15-SP2-SAP-Azure-LI-BYOS-Production:libpython3_6m1_0-3.6.15-150000.3.147.1
Image SLES15-SP2-SAP-Azure-LI-BYOS-Production:python3-3.6.15-150000.3.147.1
Image SLES15-SP2-SAP-Azure-LI-BYOS-Production:python3-base-3.6.15-150000.3.147.1
Image SLES15-SP2-SAP-Azure-LI-BYOS-Production:python3-curses-3.6.15-150000.3.147.1
Ссылки

Описание

An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The zipfile module is vulnerable to "quoted-overlap" zip-bombs which exploit the zip format to create a zip-bomb with a high compression ratio. The fixed versions of CPython makes the zipfile module reject zip archives which overlap entries in the archive.

Затронутые продукты
Image SLES15-SP2-SAP-Azure-LI-BYOS-Production:libpython3_6m1_0-3.6.15-150000.3.147.1
Image SLES15-SP2-SAP-Azure-LI-BYOS-Production:python3-3.6.15-150000.3.147.1
Image SLES15-SP2-SAP-Azure-LI-BYOS-Production:python3-base-3.6.15-150000.3.147.1
Image SLES15-SP2-SAP-Azure-LI-BYOS-Production:python3-curses-3.6.15-150000.3.147.1
Ссылки