MGASA-2024-0084 - Updated python python3 packages fix security vulnerabilities

Publication date: 23 Mar 2024
URL: https://advisories.mageia.org/MGASA-2024-0084.html
Type: security
Affected Mageia releases: 9
CVE: CVE-2022-45061,
     CVE-2022-48565,
     CVE-2022-48566,
     CVE-2023-24329,
     CVE-2023-40217

An issue was discovered in Python before 3.11.1. An unnecessary
quadratic algorithm exists in one path when processing some inputs to
the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name
being presented to the decoder could lead to a CPU denial of service.
Hostnames are often supplied by remote servers that could be controlled
by a malicious actor; in such a scenario, they could trigger excessive
CPU consumption on the client attempting to make use of an
attacker-supplied supposed hostname. (CVE-2022-45061)
An XML External Entity (XXE) issue was discovered in Python through
3.9.1. The plistlib module no longer accepts entity declarations in XML
plist files to avoid XML vulnerabilities. (CVE-2022-48565)
An issue was discovered in compare_digest in Lib/hmac.py in Python
through 3.9.1. Constant-time-defeating optimisations were possible in
the accumulator variable in hmac.compare_digest. (CVE-2022-48566)
An issue in the urllib.parse component of Python before 3.11.4 allows
attackers to bypass blocklisting methods by supplying a URL that starts
with blank characters. (CVE-2023-24329)
An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18,
3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects
servers (such as HTTP servers) that use TLS client authentication. If a
TLS server-side socket is created, receives data into the socket buffer,
and then is closed quickly, there is a brief window where the SSLSocket
instance will detect the socket as "not connected" and won't initiate a
handshake, but buffered data will still be readable from the socket
buffer. This data will not be authenticated if the server-side TLS peer
is expecting client certificate authentication, and is indistinguishable
from valid TLS stream data. Data is limited in size to the amount that
will fit in the buffer. (The TLS connection cannot directly be used for
data exfiltration because the vulnerable code path requires that the
connection be closed on initialization of the SSLSocket).
(CVE-2023-40217)

References:
- https://bugs.mageia.org/show_bug.cgi?id=31000
- https://ubuntu.com/security/notices/USN-5888-1
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/TZH26JGNZ5XYPZ5SAU3NKSBSPRE5OHTG/
- https://access.redhat.com/errata/RHSA-2023:2763
- https://access.redhat.com/errata/RHSA-2023:2860
- https://access.redhat.com/errata/RHSA-2023:3556
- https://access.redhat.com/errata/RHSA-2023:3591
- https://ubuntu.com/security/notices/USN-6139-1
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-45061
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-48565
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-48566
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24329
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40217

SRPMS:
- 9/core/python-2.7.18-15.1.mga9
- 9/core/python3-3.10.11-1.1.mga9