Описание
Security update for python312
This update for python312 fixes the following issues:
- CVE-2024-4032: Corrected information about public and private IPv4 and IPv6 address ranges (bsc#1226448).
Список пакетов
Container bci/python:latest
SUSE Linux Enterprise Module for Python 3 15 SP6
openSUSE Leap 15.6
Ссылки
- Link for SUSE-SU-2024:2572-1
- E-Mail link for SUSE-SU-2024:2572-1
- SUSE Security Ratings
- SUSE Bug 1225660
- SUSE Bug 1226447
- SUSE Bug 1226448
- SUSE Bug 1227152
- SUSE Bug 1227378
- SUSE CVE CVE-2024-0397 page
- SUSE CVE CVE-2024-4030 page
- SUSE CVE CVE-2024-4032 page
Описание
A defect was discovered in the Python "ssl" module where there is a memory race condition with the ssl.SSLContext methods "cert_store_stats()" and "get_ca_certs()". The race condition can be triggered if the methods are called at the same time as certificates are loaded into the SSLContext, such as during the TLS handshake with a certificate directory configured. This issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5.
Затронутые продукты
Ссылки
- CVE-2024-0397
- SUSE Bug 1226447
Описание
On Windows a directory returned by tempfile.mkdtemp() would not always have permissions set to restrict reading and writing to the temporary directory by other users, instead usually inheriting the correct permissions from the default location. Alternate configurations or users without a profile directory may not have the intended permissions. If you're not using Windows or haven't changed the temporary directory location then you aren't affected by this vulnerability. On other platforms the returned directory is consistently readable and writable only by the current user. This issue was caused by Python not supporting Unix permissions on Windows. The fix adds support for Unix "700" for the mkdir function on Windows which is used by mkdtemp() to ensure the newly created directory has the proper permissions.
Затронутые продукты
Ссылки
- CVE-2024-4030
- SUSE Bug 1227152
Описание
The "ipaddress" module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as "globally reachable" or "private". This affected the is_private and is_global properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network classes, where values wouldn't be returned in accordance with the latest information from the IANA Special-Purpose Address Registries. CPython 3.12.4 and 3.13.0a6 contain updated information from these registries and thus have the intended behavior.
Затронутые продукты
Ссылки
- CVE-2024-4032
- SUSE Bug 1226448