Описание
Security update for python
This update for python fixes the following issues:
- CVE-2023-52425: Fixed using the system libexpat (bsc#1219559).
- CVE-2023-27043: Modifed fix for unicode string handling in email.utils.parseaddr() (bsc#1222537).
- CVE-2022-48560: Fixed use-after-free in Python via heappushpop in heapq (bsc#1214675).
- CVE-2024-0450: Detect the vulnerability of the 'quoted-overlap' zipbomb (bsc#1221854).
Bug fixes:
- Switch off tests. ONLY FOR FACTORY!!! (bsc#1219306).
- Build with -std=gnu89 to build correctly with gcc14 (bsc#1220970).
- Switch from %patchN style to the %patch -P N one.
Список пакетов
Image SLES15-SP2-SAP-Azure-LI-BYOS-Production
Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production
Image SLES15-SP3-SAP-Azure-LI-BYOS-Production
Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production
Image SLES15-SP3-SAPCAL-Azure
Image SLES15-SP3-SAPCAL-EC2-HVM
Image SLES15-SP3-SAPCAL-GCE
SUSE Linux Enterprise Module for Package Hub 15 SP5
SUSE Linux Enterprise Module for Package Hub 15 SP6
openSUSE Leap 15.5
openSUSE Leap 15.6
Ссылки
- Link for SUSE-SU-2024:1862-1
- E-Mail link for SUSE-SU-2024:1862-1
- SUSE Security Ratings
- SUSE Bug 1214675
- SUSE Bug 1219306
- SUSE Bug 1219559
- SUSE Bug 1220970
- SUSE Bug 1221854
- SUSE Bug 1222537
- SUSE CVE CVE-2022-48560 page
- SUSE CVE CVE-2023-27043 page
- SUSE CVE CVE-2023-52425 page
- SUSE CVE CVE-2024-0450 page
Описание
A use-after-free exists in Python through 3.9 via heappushpop in heapq.
Затронутые продукты
Ссылки
- CVE-2022-48560
- SUSE Bug 1214675
Описание
The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python.
Затронутые продукты
Ссылки
- CVE-2023-27043
- SUSE Bug 1210638
- SUSE Bug 1222537
Описание
libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.
Затронутые продукты
Ссылки
- CVE-2023-52425
- SUSE Bug 1219559
Описание
An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The zipfile module is vulnerable to "quoted-overlap" zip-bombs which exploit the zip format to create a zip-bomb with a high compression ratio. The fixed versions of CPython makes the zipfile module reject zip archives which overlap entries in the archive.
Затронутые продукты
Ссылки
- CVE-2024-0450
- SUSE Bug 1221854