Описание
Security update for python36
This update for python36 fixes the following issues:
- CVE-2023-52425: Fixed backport so it uses features sniffing, not just comparing version number (bsc#1219559).
- CVE-2024-0450: Fixed detecting the vulnerability of 'quoted-overlap' zipbomb (bsc#1221854).
- CVE-2023-6597: Fixed symlink bug in cleanup of tempfile.TemporaryDirectory (bsc#1219666).
- CVE-2022-48566: Fixed compare_digest constant-time (bsc#1214691).
Bug fixes:
- Fixed syslog making default 'ident from sys.argv[0] (bsc#1222109).
Список пакетов
Image SLES12-SP5-Azure-BYOS
Image SLES12-SP5-Azure-Basic-On-Demand
Image SLES12-SP5-Azure-HPC-BYOS
Image SLES12-SP5-Azure-HPC-On-Demand
Image SLES12-SP5-Azure-SAP-BYOS
Image SLES12-SP5-Azure-SAP-On-Demand
Image SLES12-SP5-Azure-Standard-On-Demand
Image SLES12-SP5-EC2-BYOS
Image SLES12-SP5-EC2-ECS-On-Demand
Image SLES12-SP5-EC2-On-Demand
Image SLES12-SP5-EC2-SAP-BYOS
Image SLES12-SP5-EC2-SAP-On-Demand
Image SLES12-SP5-GCE-BYOS
Image SLES12-SP5-GCE-On-Demand
Image SLES12-SP5-GCE-SAP-BYOS
Image SLES12-SP5-GCE-SAP-On-Demand
Image SLES12-SP5-SAP-Azure-LI-BYOS-Production
Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production
SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise Server for SAP Applications 12 SP5
SUSE Linux Enterprise Software Development Kit 12 SP5
Ссылки
- Link for SUSE-SU-2024:1847-1
- E-Mail link for SUSE-SU-2024:1847-1
- SUSE Security Ratings
- SUSE Bug 1214691
- SUSE Bug 1219559
- SUSE Bug 1219666
- SUSE Bug 1220664
- SUSE Bug 1221563
- SUSE Bug 1221854
- SUSE Bug 1222075
- SUSE Bug 1222109
- SUSE CVE CVE-2022-48566 page
- SUSE CVE CVE-2023-52425 page
- SUSE CVE CVE-2023-6597 page
- SUSE CVE CVE-2024-0450 page
Описание
An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possible in the accumulator variable in hmac.compare_digest.
Затронутые продукты
Ссылки
- CVE-2022-48566
- SUSE Bug 1214691
Описание
libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.
Затронутые продукты
Ссылки
- CVE-2023-52425
- SUSE Bug 1219559
Описание
An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference symlinks during cleanup of permissions-related errors. This means users which can run privileged programs are potentially able to modify permissions of files referenced by symlinks in some circumstances.
Затронутые продукты
Ссылки
- CVE-2023-6597
- SUSE Bug 1219666
- SUSE Bug 1221854
- SUSE Bug 1224879
- SUSE Bug 1225185
Описание
An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The zipfile module is vulnerable to "quoted-overlap" zip-bombs which exploit the zip format to create a zip-bomb with a high compression ratio. The fixed versions of CPython makes the zipfile module reject zip archives which overlap entries in the archive.
Затронутые продукты
Ссылки
- CVE-2024-0450
- SUSE Bug 1221854