Red Hat Security AdvisoryRHSA-2023:6793
rh-python38-python security update
Released 2023-11-08 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Software Collections for RHEL Workstation(v. 7) rh-python38-python-3.8.18-2.el7, rh-python38-python-cryptography-2.8-6.el7, rh-python38-python-debug-3.8.18-2.el7 +14
- Red Hat Software Collections for RHEL(v. 7) rh-python38-python-3.8.18-2.el7, rh-python38-python-cryptography-2.8-6.el7, rh-python38-python-debug-3.8.18-2.el7 +14
Fixes 8 records
Priority HIGH 82
Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a ..
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.27095 · Published 2007-08-28 · Partial fix CWE-22
Priority HIGH 72
An issue was discovered in Python before 3.11.1.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03327 · Published 2022-11-09 · Partial fix CWE-407
Priority HIGH 72
An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02837 · Published 2022-12-22 · Partial fix · 0.38.1 CWE-20
Priority MEDIUM 62
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.01301 · Published 2023-02-07 · Partial fix · 39.0.1 CWE-754
Priority MEDIUM 58
An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.20459 · Published 2023-02-17 · Partial fix CWE-20
Priority LOW 33
Requests is a HTTP library.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.02974 · Published 2023-05-26 · Partial fix · 2.31.0 CWE-200
Priority LOW 31
An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00797 · Published 2023-08-25 · Fixed
Priority LOW 31
Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.02632 · Published 2022-12-22 · Partial fix · 65.5.1 CWE-1333
THREATIST.IORead the docs