Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Red Hat Python 3 may allow unauthorized code execution

published 2 years ago

Summary

The Python 3 runtime packaged by Red Hat contains a flaw that could let an attacker run code with the same privileges as the program using it. This could expose data or affect system stability. Apply the latest Red Hat security update for Python 3 as soon as possible to close the risk.

What to do

Update redhat platform-python to version 0:3.6.8-51.el8_8.6.
Update redhat platform-python-debug to version 0:3.6.8-51.el8_8.6.
Update redhat platform-python-devel to version 0:3.6.8-51.el8_8.6.
Update redhat python3-debuginfo to version 0:3.6.8-51.el8_8.6.
Update redhat python3-debugsource to version 0:3.6.8-51.el8_8.6.
Update redhat python3-idle to version 0:3.6.8-51.el8_8.6.
Update redhat python3-test to version 0:3.6.8-51.el8_8.6.
Update redhat python3-tkinter to version 0:3.6.8-51.el8_8.6.
Update redhat python3 to version 0:3.6.8-51.el8_8.6.
Update redhat python3-libs to version 0:3.6.8-51.el8_8.6.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:rhel_eus:8.8::appstream	redhat	platform-python	< 0:3.6.8-51.el8_8.6 Fix: upgrade to 0:3.6.8-51.el8_8.6
Red Hat:rhel_eus:8.8::appstream	redhat	platform-python-debug	< 0:3.6.8-51.el8_8.6 Fix: upgrade to 0:3.6.8-51.el8_8.6
Red Hat:rhel_eus:8.8::appstream	redhat	platform-python-devel	< 0:3.6.8-51.el8_8.6 Fix: upgrade to 0:3.6.8-51.el8_8.6
Red Hat:rhel_eus:8.8::appstream	redhat	python3-debuginfo	< 0:3.6.8-51.el8_8.6 Fix: upgrade to 0:3.6.8-51.el8_8.6
Red Hat:rhel_eus:8.8::appstream	redhat	python3-debugsource	< 0:3.6.8-51.el8_8.6 Fix: upgrade to 0:3.6.8-51.el8_8.6
Red Hat:rhel_eus:8.8::appstream	redhat	python3-idle	< 0:3.6.8-51.el8_8.6 Fix: upgrade to 0:3.6.8-51.el8_8.6
Red Hat:rhel_eus:8.8::appstream	redhat	python3-test	< 0:3.6.8-51.el8_8.6 Fix: upgrade to 0:3.6.8-51.el8_8.6
Red Hat:rhel_eus:8.8::appstream	redhat	python3-tkinter	< 0:3.6.8-51.el8_8.6 Fix: upgrade to 0:3.6.8-51.el8_8.6
Red Hat:rhel_eus:8.8::baseos	redhat	platform-python	< 0:3.6.8-51.el8_8.6 Fix: upgrade to 0:3.6.8-51.el8_8.6
Red Hat:rhel_eus:8.8::baseos	redhat	python3	< 0:3.6.8-51.el8_8.6 Fix: upgrade to 0:3.6.8-51.el8_8.6
Red Hat:rhel_eus:8.8::baseos	redhat	python3-debuginfo	< 0:3.6.8-51.el8_8.6 Fix: upgrade to 0:3.6.8-51.el8_8.6
Red Hat:rhel_eus:8.8::baseos	redhat	python3-debugsource	< 0:3.6.8-51.el8_8.6 Fix: upgrade to 0:3.6.8-51.el8_8.6
Red Hat:rhel_eus:8.8::baseos	redhat	python3-libs	< 0:3.6.8-51.el8_8.6 Fix: upgrade to 0:3.6.8-51.el8_8.6
Red Hat:rhel_eus:8.8::baseos	redhat	python3-test	< 0:3.6.8-51.el8_8.6 Fix: upgrade to 0:3.6.8-51.el8_8.6

Original advisory text

Red Hat Security Advisory: python3 security update

References

https://access.redhat.com/errata/RHSA-2024:3391 Vendor Advisory
https://access.redhat.com/security/updates/classification/#important Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2276518 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2276525 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3391.j... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2023-6597 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2023-6597 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-6597 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2024-0450 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2024-0450 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-0450 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

7.8 High

Timeline

Published12 Sep 2024

Updated25 Aug 2026

First seen25 Aug 2026

Sources

RHSA-2024:3391 · OSV

Track software like this

Free during beta