Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2024:3384-1

Опубликовано: 23 сент. 2024
Источник: suse-cvrf

Описание

Security update for python3

This update for python3 fixes the following issues:

  • CVE-2024-6232: excessive backtracking when parsing tarfile headers leads to ReDoS. (bsc#1230227)
  • CVE-2024-7592: quadratic algorithm used when parsing cookies leads to excessive resource consumption. (bsc#1229596)

Список пакетов

Image SLES12-SP5-Azure-BYOS
libpython3_4m1_0-3.4.10-25.139.1
python3-3.4.10-25.139.1
python3-base-3.4.10-25.139.1
Image SLES12-SP5-Azure-HPC-BYOS
libpython3_4m1_0-3.4.10-25.139.1
python3-3.4.10-25.139.1
python3-base-3.4.10-25.139.1
Image SLES12-SP5-Azure-HPC-On-Demand
libpython3_4m1_0-3.4.10-25.139.1
python3-3.4.10-25.139.1
python3-base-3.4.10-25.139.1
Image SLES12-SP5-Azure-SAP-BYOS
libpython3_4m1_0-3.4.10-25.139.1
python3-3.4.10-25.139.1
python3-base-3.4.10-25.139.1
python3-curses-3.4.10-25.139.1
Image SLES12-SP5-Azure-SAP-On-Demand
libpython3_4m1_0-3.4.10-25.139.1
python3-3.4.10-25.139.1
python3-base-3.4.10-25.139.1
python3-curses-3.4.10-25.139.1
Image SLES12-SP5-Azure-Standard-On-Demand
libpython3_4m1_0-3.4.10-25.139.1
python3-3.4.10-25.139.1
python3-base-3.4.10-25.139.1
Image SLES12-SP5-EC2-BYOS
libpython3_4m1_0-3.4.10-25.139.1
python3-3.4.10-25.139.1
python3-base-3.4.10-25.139.1
Image SLES12-SP5-EC2-ECS-On-Demand
libpython3_4m1_0-3.4.10-25.139.1
python3-3.4.10-25.139.1
python3-base-3.4.10-25.139.1
Image SLES12-SP5-EC2-On-Demand
libpython3_4m1_0-3.4.10-25.139.1
python3-3.4.10-25.139.1
python3-base-3.4.10-25.139.1
Image SLES12-SP5-EC2-SAP-BYOS
libpython3_4m1_0-3.4.10-25.139.1
python3-3.4.10-25.139.1
python3-base-3.4.10-25.139.1
python3-curses-3.4.10-25.139.1
Image SLES12-SP5-EC2-SAP-On-Demand
libpython3_4m1_0-3.4.10-25.139.1
python3-3.4.10-25.139.1
python3-base-3.4.10-25.139.1
python3-curses-3.4.10-25.139.1
Image SLES12-SP5-GCE-BYOS
libpython3_4m1_0-3.4.10-25.139.1
python3-3.4.10-25.139.1
python3-base-3.4.10-25.139.1
Image SLES12-SP5-GCE-On-Demand
libpython3_4m1_0-3.4.10-25.139.1
python3-3.4.10-25.139.1
python3-base-3.4.10-25.139.1
Image SLES12-SP5-GCE-SAP-BYOS
libpython3_4m1_0-3.4.10-25.139.1
python3-3.4.10-25.139.1
python3-base-3.4.10-25.139.1
python3-curses-3.4.10-25.139.1
Image SLES12-SP5-GCE-SAP-On-Demand
libpython3_4m1_0-3.4.10-25.139.1
python3-3.4.10-25.139.1
python3-base-3.4.10-25.139.1
python3-curses-3.4.10-25.139.1
Image SLES12-SP5-SAP-Azure-LI-BYOS-Production
libpython3_4m1_0-3.4.10-25.139.1
python3-3.4.10-25.139.1
python3-base-3.4.10-25.139.1
python3-curses-3.4.10-25.139.1
Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production
libpython3_4m1_0-3.4.10-25.139.1
python3-3.4.10-25.139.1
python3-base-3.4.10-25.139.1
python3-curses-3.4.10-25.139.1
SUSE Linux Enterprise Module for Web and Scripting 12
libpython3_4m1_0-3.4.10-25.139.1
python3-3.4.10-25.139.1
python3-base-3.4.10-25.139.1
python3-curses-3.4.10-25.139.1
SUSE Linux Enterprise Server 12 SP5
libpython3_4m1_0-3.4.10-25.139.1
libpython3_4m1_0-32bit-3.4.10-25.139.1
python3-3.4.10-25.139.1
python3-base-3.4.10-25.139.1
python3-curses-3.4.10-25.139.1
python3-devel-3.4.10-25.139.1
python3-tk-3.4.10-25.139.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5
libpython3_4m1_0-3.4.10-25.139.1
libpython3_4m1_0-32bit-3.4.10-25.139.1
python3-3.4.10-25.139.1
python3-base-3.4.10-25.139.1
python3-curses-3.4.10-25.139.1
python3-devel-3.4.10-25.139.1
python3-tk-3.4.10-25.139.1
SUSE Linux Enterprise Software Development Kit 12 SP5
python3-dbm-3.4.10-25.139.1
python3-devel-3.4.10-25.139.1

Описание

There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.


Затронутые продукты
Image SLES12-SP5-Azure-BYOS:libpython3_4m1_0-3.4.10-25.139.1
Image SLES12-SP5-Azure-BYOS:python3-3.4.10-25.139.1
Image SLES12-SP5-Azure-BYOS:python3-base-3.4.10-25.139.1
Image SLES12-SP5-Azure-HPC-BYOS:libpython3_4m1_0-3.4.10-25.139.1

Ссылки

Описание

There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used while parsing the value.


Затронутые продукты
Image SLES12-SP5-Azure-BYOS:libpython3_4m1_0-3.4.10-25.139.1
Image SLES12-SP5-Azure-BYOS:python3-3.4.10-25.139.1
Image SLES12-SP5-Azure-BYOS:python3-base-3.4.10-25.139.1
Image SLES12-SP5-Azure-HPC-BYOS:libpython3_4m1_0-3.4.10-25.139.1

Ссылки
Уязвимость SUSE-SU-2024:3384-1