Описание
Security update for python3
This update for python3 fixes the following issues:
- CVE-2024-6232: excessive backtracking when parsing tarfile headers leads to ReDoS. (bsc#1230227)
- CVE-2024-7592: quadratic algorithm used when parsing cookies leads to excessive resource consumption. (bsc#1229596)
Список пакетов
Image SLES12-SP5-Azure-BYOS
libpython3_4m1_0-3.4.10-25.139.1
python3-3.4.10-25.139.1
python3-base-3.4.10-25.139.1
Image SLES12-SP5-Azure-HPC-BYOS
libpython3_4m1_0-3.4.10-25.139.1
python3-3.4.10-25.139.1
python3-base-3.4.10-25.139.1
Image SLES12-SP5-Azure-HPC-On-Demand
libpython3_4m1_0-3.4.10-25.139.1
python3-3.4.10-25.139.1
python3-base-3.4.10-25.139.1
Image SLES12-SP5-Azure-SAP-BYOS
libpython3_4m1_0-3.4.10-25.139.1
python3-3.4.10-25.139.1
python3-base-3.4.10-25.139.1
python3-curses-3.4.10-25.139.1
Image SLES12-SP5-Azure-SAP-On-Demand
libpython3_4m1_0-3.4.10-25.139.1
python3-3.4.10-25.139.1
python3-base-3.4.10-25.139.1
python3-curses-3.4.10-25.139.1
Image SLES12-SP5-Azure-Standard-On-Demand
libpython3_4m1_0-3.4.10-25.139.1
python3-3.4.10-25.139.1
python3-base-3.4.10-25.139.1
Image SLES12-SP5-EC2-BYOS
libpython3_4m1_0-3.4.10-25.139.1
python3-3.4.10-25.139.1
python3-base-3.4.10-25.139.1
Image SLES12-SP5-EC2-ECS-On-Demand
libpython3_4m1_0-3.4.10-25.139.1
python3-3.4.10-25.139.1
python3-base-3.4.10-25.139.1
Image SLES12-SP5-EC2-On-Demand
libpython3_4m1_0-3.4.10-25.139.1
python3-3.4.10-25.139.1
python3-base-3.4.10-25.139.1
Image SLES12-SP5-EC2-SAP-BYOS
libpython3_4m1_0-3.4.10-25.139.1
python3-3.4.10-25.139.1
python3-base-3.4.10-25.139.1
python3-curses-3.4.10-25.139.1
Image SLES12-SP5-EC2-SAP-On-Demand
libpython3_4m1_0-3.4.10-25.139.1
python3-3.4.10-25.139.1
python3-base-3.4.10-25.139.1
python3-curses-3.4.10-25.139.1
Image SLES12-SP5-GCE-BYOS
libpython3_4m1_0-3.4.10-25.139.1
python3-3.4.10-25.139.1
python3-base-3.4.10-25.139.1
Image SLES12-SP5-GCE-On-Demand
libpython3_4m1_0-3.4.10-25.139.1
python3-3.4.10-25.139.1
python3-base-3.4.10-25.139.1
Image SLES12-SP5-GCE-SAP-BYOS
libpython3_4m1_0-3.4.10-25.139.1
python3-3.4.10-25.139.1
python3-base-3.4.10-25.139.1
python3-curses-3.4.10-25.139.1
Image SLES12-SP5-GCE-SAP-On-Demand
libpython3_4m1_0-3.4.10-25.139.1
python3-3.4.10-25.139.1
python3-base-3.4.10-25.139.1
python3-curses-3.4.10-25.139.1
Image SLES12-SP5-SAP-Azure-LI-BYOS-Production
libpython3_4m1_0-3.4.10-25.139.1
python3-3.4.10-25.139.1
python3-base-3.4.10-25.139.1
python3-curses-3.4.10-25.139.1
Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production
libpython3_4m1_0-3.4.10-25.139.1
python3-3.4.10-25.139.1
python3-base-3.4.10-25.139.1
python3-curses-3.4.10-25.139.1
SUSE Linux Enterprise Module for Web and Scripting 12
libpython3_4m1_0-3.4.10-25.139.1
python3-3.4.10-25.139.1
python3-base-3.4.10-25.139.1
python3-curses-3.4.10-25.139.1
SUSE Linux Enterprise Server 12 SP5
libpython3_4m1_0-3.4.10-25.139.1
libpython3_4m1_0-32bit-3.4.10-25.139.1
python3-3.4.10-25.139.1
python3-base-3.4.10-25.139.1
python3-curses-3.4.10-25.139.1
python3-devel-3.4.10-25.139.1
python3-tk-3.4.10-25.139.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5
libpython3_4m1_0-3.4.10-25.139.1
libpython3_4m1_0-32bit-3.4.10-25.139.1
python3-3.4.10-25.139.1
python3-base-3.4.10-25.139.1
python3-curses-3.4.10-25.139.1
python3-devel-3.4.10-25.139.1
python3-tk-3.4.10-25.139.1
SUSE Linux Enterprise Software Development Kit 12 SP5
python3-dbm-3.4.10-25.139.1
python3-devel-3.4.10-25.139.1
Ссылки
- Link for SUSE-SU-2024:3384-1
- E-Mail link for SUSE-SU-2024:3384-1
- SUSE Security Ratings
- SUSE Bug 1229596
- SUSE Bug 1230227
- SUSE CVE CVE-2024-6232 page
- SUSE CVE CVE-2024-7592 page
Описание
There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.
Затронутые продукты
Image SLES12-SP5-Azure-BYOS:libpython3_4m1_0-3.4.10-25.139.1
Image SLES12-SP5-Azure-BYOS:python3-3.4.10-25.139.1
Image SLES12-SP5-Azure-BYOS:python3-base-3.4.10-25.139.1
Image SLES12-SP5-Azure-HPC-BYOS:libpython3_4m1_0-3.4.10-25.139.1
Ссылки
- CVE-2024-6232
- SUSE Bug 1230227
Описание
There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used while parsing the value.
Затронутые продукты
Image SLES12-SP5-Azure-BYOS:libpython3_4m1_0-3.4.10-25.139.1
Image SLES12-SP5-Azure-BYOS:python3-3.4.10-25.139.1
Image SLES12-SP5-Azure-BYOS:python3-base-3.4.10-25.139.1
Image SLES12-SP5-Azure-HPC-BYOS:libpython3_4m1_0-3.4.10-25.139.1
Ссылки
- CVE-2024-7592
- SUSE Bug 1229596