Alerts This Week
Warning Icon 1 764
Alerts This Week
Warning Icon 1 764

SUSE: 2022:4072-2 Critical: Python39 Security Update Release

suse
Calendar Grey November 18, 2022
Dist Suse Esm H88
Crucial SUSE Security Patch for python39 resolves a pair of severe vulnerabilities; installation guidelines provided.
An update that fixes two vulnerabilities is now available

Summary

This update for python39 fixes the following issues: Security fixes: - CVE-2022-42919: Fixed local privilege escalation via the multiprocessing forkserver start method (bsc#1204886). - CVE-2022-45061: Fixed a quadratic IDNA decoding time (bsc#1205244). Other fixes: - Allow building of documentation with the latest Sphinx 5.3.0 (gh#python/cpython#98366). - Update to 3.9.15: - Fix multiplying a list by an integer (list *= int): detect the integer overflow when the new allocated length is close to the maximum size. - Fix a shell code injection vulnerability in the get-remote-certificate.py example script. The script no longer uses a shell to run openssl commands. (originally filed as CVE-2022-37460, later withdrawn) - Fix command line parsing: reject -X int_max_str_digits option with no

Topics%20covered

Topics Covered

security advisory critical fix local escalation SUSE Linux Python security

References

#1204886 #1205244

Cross- CVE-2022-42919 CVE-2022-45061

CVSS scores:

CVE-2022-42919 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2022-42919 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2022-45061 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2022-45061 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected Products:

SUSE Enterprise Storage 7.1

SUSE Linux Enterprise Desktop 15-SP3

SUSE Linux Enterprise High Performance Computing 15-SP3

SUSE Linux Enterprise Module for Basesystem 15-SP3

SUSE Linux Enterprise Module for Development Tools 15-SP3

SUSE Linux Enterprise Server 15-SP3

SUSE Linux Enterprise Server for SAP Applications 15-SP3

SUSE Manager Proxy 4.2

SUSE Manager Retail ...

Read the Full Advisory

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2022:4071-1
Rating: important

Topics%20covered

Topics Covered

security advisory critical fix local escalation SUSE Linux Python security

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here