Stay Secure with the Latest Linux Advisories

security advisoryUbuntumoderate severity

Ubuntu 23.04: USN-6139-1 Moderate: Python Blocklist Bypass Exploit

Python could be made to bypass blocklisting methods if a specially crafted URL was provided. =========================================================================Ubuntu Security Notice USN-6139-1 June 05, 2023 python2.7, python3.10, python3.11, python3.5, python3.6, python3.8 vulnerability ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 23.04 - Ubuntu 22.10 - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS (Available with Ubuntu Pro) - Ubuntu 16.04 LTS (Available with Ubuntu Pro) - Ubuntu 14.04 LTS (Available with Ubuntu Pro) Summary: Python could be made to bypass blocklisting methods if a specially crafted URL was provided Software Description: - python3.11: An interactive high-level object-oriented language - python3.10: An interactive high-level object-oriented language - python3.8: An interactive high-level object-oriented language - python2.7: An interactive high-level object-oriented language - python3.6: An interactive high-level object-oriented language - python3.5: An interactive high-level object-oriented language Details: Yebo Cao discovered that Python incorrectly handled certain URLs. An attacker could use this issue to bypass blockinglisting methods. This issue was first addressed in USN-5960-1, but was incomplete. Here we address an additional fix to that issue. (CVE-2023-24329) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 23.04: python3.11 3.11.2-6ubuntu0.1 Ubuntu 22.10: python3.10 3.10.7-1ubuntu0.4 Ubuntu 22.04 LTS: python3.10 3.10.6-1~22.04.2ubuntu1.1 Ubuntu 20.04 LTS: python3.8 3.8.10-0ubuntu1~20.04.8 Ubuntu 18.04 LTS (Available with Ubuntu Pro): python2.7 2.7.17-1~18.04ubuntu1.13 python3.6 3.6.9-1~18.04ubuntu1.13 Ubuntu 16.04 LTS (Available with UbuntuPro): python2.7 2.7.12-1ubuntu0~16.04.18+esm5 python3.5 3.5.2-2ubuntu0~16.04.13+esm8 Ubuntu 14.04 LTS (Available with Ubuntu Pro): python2.7 2.7.6-8ubuntu0.6+esm15 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-6139-1 CVE-2023-24329 Package Information: https://launchpad.net/ubuntu/+source/python3.11/3.11.2-6ubuntu0.1 https://launchpad.net/ubuntu/+source/python3.10/3.10.7-1ubuntu0.4 https://launchpad.net/ubuntu/+source/python3.10/3.10.6-1~22.04.2ubuntu1.1 https://launchpad.net/ubuntu/+source/python3.8/3.8.10-0ubuntu1~20.04.8 . Ubuntu's latest Python security update fixes a critical vulnerability that allows bypassing function restrictions. It's crucial to update to minimize risks and secure installations.. Python Security Patch, Ubuntu Security Notice, Blocklisting Bypass, Vulnerability Advisory. . LinuxSecurity.com Team

Jun 05, 2023 Ubuntu