TI-2024-07037 CVE-2024-7592 · GHSA-7pwv-g7hj-39pr
Quadratic complexity parsing cookies with backslashes
Priority HIGH 72
There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module.
RHSA-2024:10983
python3.9:3.9.21 security update
Released 2024-12-12 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat CodeReady Linux Builder (v. 9) python3-3.9.21-1.el9_5, python3-debug-3.9.21-1.el9_5, python3-idle-3.9.21-1.el9_5 +2
- Red Hat Enterprise Linux AppStream (v. 9) python-unversioned-command-3.9.21-1.el9_5, python3-devel-3.9.21-1.el9_5, python3-tkinter-3.9.21-1.el9_5
- Red Hat Enterprise Linux BaseOS (v. 9) python3-3.9.21-1.el9_5, python3-libs-3.9.21-1.el9_5, python3.9-3.9.21-1.el9_5
Fixes 4 records
TI-2024-10345 CVE-2024-11168 · GHSA-qxg5-mcmp-m3m9
Improper validation of IPv6 and IPvFuture addresses
Priority LOW 37
The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture.
TI-2024-00360 CVE-2024-0397 · GHSA-xhf3-pp4q-gxh5
Memory race condition in ssl.SSLContext certificate store methods
Priority LOW 36
A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”.
TI-2024-08621 CVE-2024-9287 · GHSA-grqq-hcc7-crmr
Virtual environment (venv) activation scripts don't quote paths
Priority LOW 27
A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment…