Red Hat Product Errata RHSA-2024:6975 - Security Advisory
Issued:
2024-09-24
Updated:
2024-09-24

RHSA-2024:6975 - Security Advisory

Synopsis

Moderate: python3 security update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for python3 is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

  • python: incorrect IPv4 and IPv6 private ranges (CVE-2024-4032)
  • cpython: python: email module doesn't properly quotes newlines in email headers, allowing header injection (CVE-2024-6923)
  • python: cpython: tarfile: ReDos via excessive backtracking while parsing header values (CVE-2024-6232)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 8 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 8 s390x
  • Red Hat Enterprise Linux for Power, little endian 8 ppc64le
  • Red Hat Enterprise Linux for ARM 64 8 aarch64

Fixes

  • BZ - 2292921 - CVE-2024-4032 python: incorrect IPv4 and IPv6 private ranges
  • BZ - 2302255 - CVE-2024-6923 cpython: python: email module doesn't properly quotes newlines in email headers, allowing header injection
  • BZ - 2309426 - CVE-2024-6232 python: cpython: tarfile: ReDos via excessive backtracking while parsing header values
  • RHEL-48605 - Fedora 40+ mock cannot bootstrap RHEL 8 chroots: nothing provides /usr/libexec/platform-python needed by python3-dnf

Red Hat Enterprise Linux for x86_64 8

SRPM
python3-3.6.8-67.el8_10.src.rpm SHA-256: 6cdd0901a9176dab859b2cea437402b9c1d4d082d648a1f771e1880e45e03198
x86_64
platform-python-3.6.8-67.el8_10.i686.rpm SHA-256: 50d42beb54fe72f03225a9e2ccb1ef102a10715f9a0aa64c547d8a85268335a0
platform-python-3.6.8-67.el8_10.x86_64.rpm SHA-256: 67e933832ab26ec2829311b1cbbe77aed715fe419d9c1abf170a9f3d98e6ca91
platform-python-debug-3.6.8-67.el8_10.i686.rpm SHA-256: bfdb5c9e53b637dcad1337416f9a8e6c1a82f684dfa0abeebbe2c931f06a462e
platform-python-debug-3.6.8-67.el8_10.x86_64.rpm SHA-256: 8e38cae6e3b19ddfe685540f6aa02342c12de3608a16f18c1b63795cc3acb6b2
platform-python-devel-3.6.8-67.el8_10.i686.rpm SHA-256: 9846d61fce3892b3ebe4ad7bca8142869d3a7e8f1ace8fdaee610f7f8d60068f
platform-python-devel-3.6.8-67.el8_10.x86_64.rpm SHA-256: 44758fdca6343f756b2393b70947e702afbb6480875035fa7631701a21dedb80
python3-debuginfo-3.6.8-67.el8_10.i686.rpm SHA-256: 1b29afd393facdf34d2386ccc9419dccfccdea55ec8fbdc2ec9f3b6aee09cb17
python3-debuginfo-3.6.8-67.el8_10.i686.rpm SHA-256: 1b29afd393facdf34d2386ccc9419dccfccdea55ec8fbdc2ec9f3b6aee09cb17
python3-debuginfo-3.6.8-67.el8_10.x86_64.rpm SHA-256: b4d438df9c5405d29cf85ce6681dfe6b6fc227874fedd2348d711fa58885702d
python3-debuginfo-3.6.8-67.el8_10.x86_64.rpm SHA-256: b4d438df9c5405d29cf85ce6681dfe6b6fc227874fedd2348d711fa58885702d
python3-debugsource-3.6.8-67.el8_10.i686.rpm SHA-256: fa1c9c6aa584f13a114e04c2c94e84383f572dc61ee81eafd8ea21daf5e39f2d
python3-debugsource-3.6.8-67.el8_10.i686.rpm SHA-256: fa1c9c6aa584f13a114e04c2c94e84383f572dc61ee81eafd8ea21daf5e39f2d
python3-debugsource-3.6.8-67.el8_10.x86_64.rpm SHA-256: 9a6c6bf749b47d23d36510938b169d09a326c11f2b16f1a3508a42664c6ecbe8
python3-debugsource-3.6.8-67.el8_10.x86_64.rpm SHA-256: 9a6c6bf749b47d23d36510938b169d09a326c11f2b16f1a3508a42664c6ecbe8
python3-idle-3.6.8-67.el8_10.i686.rpm SHA-256: e441d4a214fa9d75c05bba49fab47257298cc320e4829b7cc53263e5c324d019
python3-idle-3.6.8-67.el8_10.x86_64.rpm SHA-256: 3ed94ff281059e0ea9ae7cc95ad289312924797b619a40812f6a6b875427ef77
python3-libs-3.6.8-67.el8_10.i686.rpm SHA-256: 6a2bbe36d602282b0576cbbefaf0f60729ce7d6ef30f9d9fcfe341ef61b93f87
python3-libs-3.6.8-67.el8_10.x86_64.rpm SHA-256: 84e18ed58a8a512abc0a4a065cef63ad937c5761b7255209723998b88e31e95e
python3-test-3.6.8-67.el8_10.i686.rpm SHA-256: 75a5184db21cf369d6863173d17a60081ee538ef69c1aaafd40cc42ebe35aa7a
python3-test-3.6.8-67.el8_10.x86_64.rpm SHA-256: 80b5bf89dc267a420ec93f357dcde0dac711e18ad2224b47445ac55303d2f4fe
python3-tkinter-3.6.8-67.el8_10.i686.rpm SHA-256: 60ef8643b002640a875e4f91836ed3eb968d4b741f4770f9b7f6197a4507f23f
python3-tkinter-3.6.8-67.el8_10.x86_64.rpm SHA-256: 72dec5aa48f2092a02437522d1381766854aec203fc2867d21d906de4ba06c50

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
python3-3.6.8-67.el8_10.src.rpm SHA-256: 6cdd0901a9176dab859b2cea437402b9c1d4d082d648a1f771e1880e45e03198
s390x
platform-python-3.6.8-67.el8_10.s390x.rpm SHA-256: 7068f4eb78b41fb6909280a566016892862d332c9e63785953c5831ea1ef9937
platform-python-debug-3.6.8-67.el8_10.s390x.rpm SHA-256: bb49ba2f6c7188d9097c195e2e23e5f4d615cf7a8c1917c7e4ee465da5cc274e
platform-python-devel-3.6.8-67.el8_10.s390x.rpm SHA-256: f282555c03b2879abdc7becf5035f5f156553d30a8ffaefd3e37eaf338631aad
python3-debuginfo-3.6.8-67.el8_10.s390x.rpm SHA-256: 4a3b21ad9f6f99a02f0eff1b29d89cc5243fe448cab103ccc85f20fdce6fbc5f
python3-debuginfo-3.6.8-67.el8_10.s390x.rpm SHA-256: 4a3b21ad9f6f99a02f0eff1b29d89cc5243fe448cab103ccc85f20fdce6fbc5f
python3-debugsource-3.6.8-67.el8_10.s390x.rpm SHA-256: 8d29aef4f6edd657728268ef546e7dca8561aabbe0a6550da6395f643db31d75
python3-debugsource-3.6.8-67.el8_10.s390x.rpm SHA-256: 8d29aef4f6edd657728268ef546e7dca8561aabbe0a6550da6395f643db31d75
python3-idle-3.6.8-67.el8_10.s390x.rpm SHA-256: 01d36a59354b87d8501c5cecab0130d98a01027785d8768aeb89a001fa968102
python3-libs-3.6.8-67.el8_10.s390x.rpm SHA-256: e815b31bcec810a8ad09e3c4c03d66d5a165c9a7f750922a927223c52e991a78
python3-test-3.6.8-67.el8_10.s390x.rpm SHA-256: 063fc165a0fcc200667e705fdf8c681191580f0960d4005af3ac51462975144e
python3-tkinter-3.6.8-67.el8_10.s390x.rpm SHA-256: 4b210cb0e57aa88dd07adbdd54d1791207294b2dd4a1be088eeadb5489c3bf7c

Red Hat Enterprise Linux for Power, little endian 8

SRPM
python3-3.6.8-67.el8_10.src.rpm SHA-256: 6cdd0901a9176dab859b2cea437402b9c1d4d082d648a1f771e1880e45e03198
ppc64le
platform-python-3.6.8-67.el8_10.ppc64le.rpm SHA-256: 90fc2ec95be8d3ffd7acc877f8c79a025bc2d5f6dbdcdee62fe75c4427c256bc
platform-python-debug-3.6.8-67.el8_10.ppc64le.rpm SHA-256: 8e9d6b6e8ef983dc4aa8564130cf5c2ed3359242ce6d2206487b688653f6573e
platform-python-devel-3.6.8-67.el8_10.ppc64le.rpm SHA-256: b9f688eb8d47b7cf346aee6e9de58fa42926a94cd0b07bf3dd5d86a53b486b3d
python3-debuginfo-3.6.8-67.el8_10.ppc64le.rpm SHA-256: 0d0971263f66f225c84e1856cf79d6ed16f6014fc3ae708b6104442e1b45b147
python3-debuginfo-3.6.8-67.el8_10.ppc64le.rpm SHA-256: 0d0971263f66f225c84e1856cf79d6ed16f6014fc3ae708b6104442e1b45b147
python3-debugsource-3.6.8-67.el8_10.ppc64le.rpm SHA-256: eae95d22fae69e443e0b137296379bdff04e324cea697f3c2533e28393ca0b53
python3-debugsource-3.6.8-67.el8_10.ppc64le.rpm SHA-256: eae95d22fae69e443e0b137296379bdff04e324cea697f3c2533e28393ca0b53
python3-idle-3.6.8-67.el8_10.ppc64le.rpm SHA-256: a93e076f4437777b95ea4c470967cdb3a0b90fb4bdd3631a775cf1947c5dc9fc
python3-libs-3.6.8-67.el8_10.ppc64le.rpm SHA-256: a3d7230c0ed99cfa30e355f9735619c14f54bd094899aa6efa8b28d17ca62bb9
python3-test-3.6.8-67.el8_10.ppc64le.rpm SHA-256: a2159aee68bdc53a20ca977fce55789beac7de8183579b0b122cc980d344efd9
python3-tkinter-3.6.8-67.el8_10.ppc64le.rpm SHA-256: 58f6151934d5ee80536f2c97e209638eb2c55700c1daeb5532c63baa09ade219

Red Hat Enterprise Linux for ARM 64 8

SRPM
python3-3.6.8-67.el8_10.src.rpm SHA-256: 6cdd0901a9176dab859b2cea437402b9c1d4d082d648a1f771e1880e45e03198
aarch64
platform-python-3.6.8-67.el8_10.aarch64.rpm SHA-256: cce542e4c9b8c4b67a04cae4a4f7eed054de6ff1bb31589143f4abaabeb7d2a9
platform-python-debug-3.6.8-67.el8_10.aarch64.rpm SHA-256: acfe87dd968f9cfd2299df3a136301f2b4c01c62028e2240e4e3881d435926da
platform-python-devel-3.6.8-67.el8_10.aarch64.rpm SHA-256: 405c5a0360ef43bf71b07859833efd20986da73f84c7f8efffb244ea1d677d45
python3-debuginfo-3.6.8-67.el8_10.aarch64.rpm SHA-256: 67bd9be7dd23fce0f04891c63987f7c867c13e65301f317a9a6acd2a2e38ea6b
python3-debuginfo-3.6.8-67.el8_10.aarch64.rpm SHA-256: 67bd9be7dd23fce0f04891c63987f7c867c13e65301f317a9a6acd2a2e38ea6b
python3-debugsource-3.6.8-67.el8_10.aarch64.rpm SHA-256: a54f186dcfacfa03db2a8b2d145b289746a52da4466f5f9d4e06fd596d735c45
python3-debugsource-3.6.8-67.el8_10.aarch64.rpm SHA-256: a54f186dcfacfa03db2a8b2d145b289746a52da4466f5f9d4e06fd596d735c45
python3-idle-3.6.8-67.el8_10.aarch64.rpm SHA-256: 70ee5531f1156d7be1cb613d3af9eeb3873f0691dd04d22df3676b9b53be6030
python3-libs-3.6.8-67.el8_10.aarch64.rpm SHA-256: c1ebb51aafd275df7e3e70f6ee51e82f243878172fe897c0efdb14d0ce8ee054
python3-test-3.6.8-67.el8_10.aarch64.rpm SHA-256: b35aa7e3ae63354e76b6aa7396702987630d505367ba0ee18b985cb0654b2eec
python3-tkinter-3.6.8-67.el8_10.aarch64.rpm SHA-256: 85a367f5867cb0be7d5e1fb90924ef6f7e265a331f0ba8718ee8e3b7104d5fdc

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.