Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Cython, PyYAML and Babel could let attackers run code

published 2 years ago

Summary

The Cython, PyYAML and Babel libraries that ship with Python 3.8 on Red Hat can be tricked into executing malicious code when they handle specially crafted input. This could let an attacker take control of the affected system or steal data. Install the latest security updates for these packages from Red Hat as soon as possible.

What to do

Update redhat cython to version 0:0.29.14-4.module+el8.4.0+8888+89bc7e79.
Update redhat cython-debugsource to version 0:0.29.14-4.module+el8.4.0+8888+89bc7e79.
Update redhat pyyaml to version 0:5.4.1-1.module+el8.5.0+10721+14d8e0d5.
Update redhat pyyaml-debugsource to version 0:5.4.1-1.module+el8.5.0+10721+14d8e0d5.
Update redhat babel to version 0:2.7.0-11.module+el8.5.0+11015+9c1c7c42.
Update redhat mod_wsgi to version 0:4.6.8-4.module+el8.7.0+16653+23ccaf52.
Update redhat numpy to version 0:1.17.3-6.module+el8.5.0+12205+a865257a.
Update redhat numpy-debugsource to version 0:1.17.3-6.module+el8.5.0+12205+a865257a.
Update redhat python-pymysql to version 0:0.10.1-1.module+el8.4.0+9692+8e86ab84.
Update redhat python-asn1crypto to version 0:1.2.0-3.module+el8.4.0+8888+89bc7e79.
Update redhat python-cffi to version 0:1.13.2-3.module+el8.4.0+8888+89bc7e79.
Update redhat python-cffi-debugsource to version 0:1.13.2-3.module+el8.4.0+8888+89bc7e79.
Update redhat python-chardet to version 0:3.0.4-19.module+el8.4.0+8888+89bc7e79.
Update redhat python-cryptography to version 0:2.8-3.module+el8.4.0+8888+89bc7e79.
Update redhat python-cryptography-debugsource to version 0:2.8-3.module+el8.4.0+8888+89bc7e79.
Update redhat python-idna to version 0:2.8-6.module+el8.4.0+8888+89bc7e79.
Update redhat python-jinja2 to version 0:2.11.3-1.module+el8.7.0+15575+d005caff.
Update redhat python-lxml to version 0:4.4.1-7.module+el8.6.0+13958+214a5473.
Update redhat python-lxml-debugsource to version 0:4.4.1-7.module+el8.6.0+13958+214a5473.
Update redhat python-markupsafe to version 0:1.1.1-6.module+el8.4.0+8888+89bc7e79.
Update redhat python-markupsafe-debugsource to version 0:1.1.1-6.module+el8.4.0+8888+89bc7e79.
Update redhat python-ply to version 0:3.11-10.module+el8.4.0+9579+e9717e18.
Update redhat python-psutil to version 0:5.6.4-4.module+el8.5.0+12031+10ce4870.
Update redhat python-psutil-debugsource to version 0:5.6.4-4.module+el8.5.0+12031+10ce4870.
Update redhat python-psycopg2 to version 0:2.8.4-4.module+el8.4.0+8888+89bc7e79.
Update redhat python-psycopg2-debugsource to version 0:2.8.4-4.module+el8.4.0+8888+89bc7e79.
Update redhat python-pycparser to version 0:2.19-3.module+el8.4.0+8888+89bc7e79.
Update redhat python-pysocks to version 0:1.7.1-4.module+el8.4.0+8888+89bc7e79.
Update redhat python-requests to version 0:2.22.0-9.module+el8.4.0+8888+89bc7e79.
Update redhat python-urllib3 to version 0:1.25.7-5.module+el8.5.0+11639+ea5b349d.
Update redhat python-wheel to version 0:0.33.6-6.module+el8.5.0+12205+a865257a.
Update redhat python38 to version 0:3.8.16-1.module+el8.8.0+17624+9a09af5a.
Update redhat python38-cython to version 0:0.29.14-4.module+el8.4.0+8888+89bc7e79.
Update redhat python38-cython-debuginfo to version 0:0.29.14-4.module+el8.4.0+8888+89bc7e79.
Update redhat python38-pymysql to version 0:0.10.1-1.module+el8.4.0+9692+8e86ab84.
Update redhat python38-asn1crypto to version 0:1.2.0-3.module+el8.4.0+8888+89bc7e79.
Update redhat python38-babel to version 0:2.7.0-11.module+el8.5.0+11015+9c1c7c42.
Update redhat python38-cffi to version 0:1.13.2-3.module+el8.4.0+8888+89bc7e79.
Update redhat python38-cffi-debuginfo to version 0:1.13.2-3.module+el8.4.0+8888+89bc7e79.
Update redhat python38-chardet to version 0:3.0.4-19.module+el8.4.0+8888+89bc7e79.
Update redhat python38-cryptography to version 0:2.8-3.module+el8.4.0+8888+89bc7e79.
Update redhat python38-cryptography-debuginfo to version 0:2.8-3.module+el8.4.0+8888+89bc7e79.
Update redhat python38-debug to version 0:3.8.16-1.module+el8.8.0+17624+9a09af5a.
Update redhat python38-debuginfo to version 0:3.8.16-1.module+el8.8.0+17624+9a09af5a.
Update redhat python38-debugsource to version 0:3.8.16-1.module+el8.8.0+17624+9a09af5a.
Update redhat python38-devel to version 0:3.8.16-1.module+el8.8.0+17624+9a09af5a.
Update redhat python38-idle to version 0:3.8.16-1.module+el8.8.0+17624+9a09af5a.
Update redhat python38-idna to version 0:2.8-6.module+el8.4.0+8888+89bc7e79.
Update redhat python38-jinja2 to version 0:2.11.3-1.module+el8.7.0+15575+d005caff.
Update redhat python38-libs to version 0:3.8.16-1.module+el8.8.0+17624+9a09af5a.
Update redhat python38-lxml to version 0:4.4.1-7.module+el8.6.0+13958+214a5473.
Update redhat python38-lxml-debuginfo to version 0:4.4.1-7.module+el8.6.0+13958+214a5473.
Update redhat python38-markupsafe to version 0:1.1.1-6.module+el8.4.0+8888+89bc7e79.
Update redhat python38-markupsafe-debuginfo to version 0:1.1.1-6.module+el8.4.0+8888+89bc7e79.
Update redhat python38-mod_wsgi to version 0:4.6.8-4.module+el8.7.0+16653+23ccaf52.
Update redhat python38-numpy to version 0:1.17.3-6.module+el8.5.0+12205+a865257a.
Update redhat python38-numpy-debuginfo to version 0:1.17.3-6.module+el8.5.0+12205+a865257a.
Update redhat python38-numpy-doc to version 0:1.17.3-6.module+el8.5.0+12205+a865257a.
Update redhat python38-numpy-f2py to version 0:1.17.3-6.module+el8.5.0+12205+a865257a.
Update redhat python38-pip to version 0:19.3.1-6.module+el8.7.0+15823+8950cfa7.
Update redhat python38-pip-wheel to version 0:19.3.1-6.module+el8.7.0+15823+8950cfa7.
Update redhat python38-ply to version 0:3.11-10.module+el8.4.0+9579+e9717e18.
Update redhat python38-psutil to version 0:5.6.4-4.module+el8.5.0+12031+10ce4870.
Update redhat python38-psutil-debuginfo to version 0:5.6.4-4.module+el8.5.0+12031+10ce4870.
Update redhat python38-psycopg2 to version 0:2.8.4-4.module+el8.4.0+8888+89bc7e79.
Update redhat python38-psycopg2-debuginfo to version 0:2.8.4-4.module+el8.4.0+8888+89bc7e79.
Update redhat python38-psycopg2-doc to version 0:2.8.4-4.module+el8.4.0+8888+89bc7e79.
Update redhat python38-psycopg2-tests to version 0:2.8.4-4.module+el8.4.0+8888+89bc7e79.
Update redhat python38-pycparser to version 0:2.19-3.module+el8.4.0+8888+89bc7e79.
Update redhat python38-pysocks to version 0:1.7.1-4.module+el8.4.0+8888+89bc7e79.
Update redhat python38-pytz to version 0:2019.3-3.module+el8.4.0+8888+89bc7e79.
Update redhat python38-pyyaml to version 0:5.4.1-1.module+el8.5.0+10721+14d8e0d5.
Update redhat python38-pyyaml-debuginfo to version 0:5.4.1-1.module+el8.5.0+10721+14d8e0d5.
Update redhat python38-requests to version 0:2.22.0-9.module+el8.4.0+8888+89bc7e79.
Update redhat python38-rpm-macros to version 0:3.8.16-1.module+el8.8.0+17624+9a09af5a.
Update redhat python38-scipy to version 0:1.3.1-4.module+el8.4.0+8888+89bc7e79.
Update redhat python38-scipy-debuginfo to version 0:1.3.1-4.module+el8.4.0+8888+89bc7e79.
Update redhat python38-setuptools to version 0:41.6.0-5.module+el8.5.0+12205+a865257a.
Update redhat python38-setuptools-wheel to version 0:41.6.0-5.module+el8.5.0+12205+a865257a.
Update redhat python38-six to version 0:1.12.0-10.module+el8.4.0+8888+89bc7e79.
Update redhat python38-test to version 0:3.8.16-1.module+el8.8.0+17624+9a09af5a.
Update redhat python38-tkinter to version 0:3.8.16-1.module+el8.8.0+17624+9a09af5a.
Update redhat python38-urllib3 to version 0:1.25.7-5.module+el8.5.0+11639+ea5b349d.
Update redhat python38-wheel to version 0:0.33.6-6.module+el8.5.0+12205+a865257a.
Update redhat python38-wheel-wheel to version 0:0.33.6-6.module+el8.5.0+12205+a865257a.
Update redhat python3x-pip to version 0:19.3.1-6.module+el8.7.0+15823+8950cfa7.
Update redhat python3x-setuptools to version 0:41.6.0-5.module+el8.5.0+12205+a865257a.
Update redhat python3x-six to version 0:1.12.0-10.module+el8.4.0+8888+89bc7e79.
Update redhat pytz to version 0:2019.3-3.module+el8.4.0+8888+89bc7e79.
Update redhat scipy to version 0:1.3.1-4.module+el8.4.0+8888+89bc7e79.
Update redhat scipy-debugsource to version 0:1.3.1-4.module+el8.4.0+8888+89bc7e79.
Update redhat pytest to version 0:4.6.6-3.module+el8.4.0+8888+89bc7e79.
Update redhat python-atomicwrites to version 0:1.3.0-8.module+el8.4.0+8888+89bc7e79.
Update redhat python-attrs to version 0:19.3.0-3.module+el8.4.0+8888+89bc7e79.
Update redhat python-more-itertools to version 0:7.2.0-5.module+el8.4.0+8888+89bc7e79.
Update redhat python-packaging to version 0:19.2-3.module+el8.4.0+8888+89bc7e79.
Update redhat python-pluggy to version 0:0.13.0-3.module+el8.4.0+8888+89bc7e79.
Update redhat python-py to version 0:1.8.0-8.module+el8.4.0+8888+89bc7e79.
Update redhat python-wcwidth to version 0:0.1.7-16.module+el8.4.0+8888+89bc7e79.
Update redhat python38-atomicwrites to version 0:1.3.0-8.module+el8.4.0+8888+89bc7e79.
Update redhat python38-attrs to version 0:19.3.0-3.module+el8.4.0+8888+89bc7e79.
Update redhat python38-more-itertools to version 0:7.2.0-5.module+el8.4.0+8888+89bc7e79.
Update redhat python38-packaging to version 0:19.2-3.module+el8.4.0+8888+89bc7e79.
Update redhat python38-pluggy to version 0:0.13.0-3.module+el8.4.0+8888+89bc7e79.
Update redhat python38-py to version 0:1.8.0-8.module+el8.4.0+8888+89bc7e79.
Update redhat python38-pyparsing to version 0:2.4.5-3.module+el8.4.0+8888+89bc7e79.
Update redhat python38-pytest to version 0:4.6.6-3.module+el8.4.0+8888+89bc7e79.
Update redhat python38-wcwidth to version 0:0.1.7-16.module+el8.4.0+8888+89bc7e79.
Update redhat python3x-pyparsing to version 0:2.4.5-3.module+el8.4.0+8888+89bc7e79.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:enterprise_linux:8::appstream	redhat	cython	< 0:0.29.14-4.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:0.29.14-4.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::appstream	redhat	cython-debugsource	< 0:0.29.14-4.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:0.29.14-4.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::appstream	redhat	pyyaml	< 0:5.4.1-1.module+el8.5.0+10721+14d8e0d5 Fix: upgrade to 0:5.4.1-1.module+el8.5.0+10721+14d8e0d5
Red Hat:enterprise_linux:8::appstream	redhat	pyyaml-debugsource	< 0:5.4.1-1.module+el8.5.0+10721+14d8e0d5 Fix: upgrade to 0:5.4.1-1.module+el8.5.0+10721+14d8e0d5
Red Hat:enterprise_linux:8::appstream	redhat	babel	< 0:2.7.0-11.module+el8.5.0+11015+9c1c7c42 Fix: upgrade to 0:2.7.0-11.module+el8.5.0+11015+9c1c7c42
Red Hat:enterprise_linux:8::appstream	redhat	mod_wsgi	< 0:4.6.8-4.module+el8.7.0+16653+23ccaf52 Fix: upgrade to 0:4.6.8-4.module+el8.7.0+16653+23ccaf52
Red Hat:enterprise_linux:8::appstream	redhat	numpy	< 0:1.17.3-6.module+el8.5.0+12205+a865257a Fix: upgrade to 0:1.17.3-6.module+el8.5.0+12205+a865257a
Red Hat:enterprise_linux:8::appstream	redhat	numpy-debugsource	< 0:1.17.3-6.module+el8.5.0+12205+a865257a Fix: upgrade to 0:1.17.3-6.module+el8.5.0+12205+a865257a
Red Hat:enterprise_linux:8::appstream	redhat	python-pymysql	< 0:0.10.1-1.module+el8.4.0+9692+8e86ab84 Fix: upgrade to 0:0.10.1-1.module+el8.4.0+9692+8e86ab84
Red Hat:enterprise_linux:8::appstream	redhat	python-asn1crypto	< 0:1.2.0-3.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:1.2.0-3.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::appstream	redhat	python-cffi	< 0:1.13.2-3.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:1.13.2-3.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::appstream	redhat	python-cffi-debugsource	< 0:1.13.2-3.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:1.13.2-3.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::appstream	redhat	python-chardet	< 0:3.0.4-19.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:3.0.4-19.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::appstream	redhat	python-cryptography	< 0:2.8-3.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:2.8-3.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::appstream	redhat	python-cryptography-debugsource	< 0:2.8-3.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:2.8-3.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::appstream	redhat	python-idna	< 0:2.8-6.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:2.8-6.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::appstream	redhat	python-jinja2	< 0:2.11.3-1.module+el8.7.0+15575+d005caff Fix: upgrade to 0:2.11.3-1.module+el8.7.0+15575+d005caff
Red Hat:enterprise_linux:8::appstream	redhat	python-lxml	< 0:4.4.1-7.module+el8.6.0+13958+214a5473 Fix: upgrade to 0:4.4.1-7.module+el8.6.0+13958+214a5473
Red Hat:enterprise_linux:8::appstream	redhat	python-lxml-debugsource	< 0:4.4.1-7.module+el8.6.0+13958+214a5473 Fix: upgrade to 0:4.4.1-7.module+el8.6.0+13958+214a5473
Red Hat:enterprise_linux:8::appstream	redhat	python-markupsafe	< 0:1.1.1-6.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:1.1.1-6.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::appstream	redhat	python-markupsafe-debugsource	< 0:1.1.1-6.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:1.1.1-6.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::appstream	redhat	python-ply	< 0:3.11-10.module+el8.4.0+9579+e9717e18 Fix: upgrade to 0:3.11-10.module+el8.4.0+9579+e9717e18
Red Hat:enterprise_linux:8::appstream	redhat	python-psutil	< 0:5.6.4-4.module+el8.5.0+12031+10ce4870 Fix: upgrade to 0:5.6.4-4.module+el8.5.0+12031+10ce4870
Red Hat:enterprise_linux:8::appstream	redhat	python-psutil-debugsource	< 0:5.6.4-4.module+el8.5.0+12031+10ce4870 Fix: upgrade to 0:5.6.4-4.module+el8.5.0+12031+10ce4870
Red Hat:enterprise_linux:8::appstream	redhat	python-psycopg2	< 0:2.8.4-4.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:2.8.4-4.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::appstream	redhat	python-psycopg2-debugsource	< 0:2.8.4-4.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:2.8.4-4.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::appstream	redhat	python-pycparser	< 0:2.19-3.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:2.19-3.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::appstream	redhat	python-pysocks	< 0:1.7.1-4.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:1.7.1-4.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::appstream	redhat	python-requests	< 0:2.22.0-9.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:2.22.0-9.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::appstream	redhat	python-urllib3	< 0:1.25.7-5.module+el8.5.0+11639+ea5b349d Fix: upgrade to 0:1.25.7-5.module+el8.5.0+11639+ea5b349d
Red Hat:enterprise_linux:8::appstream	redhat	python-wheel	< 0:0.33.6-6.module+el8.5.0+12205+a865257a Fix: upgrade to 0:0.33.6-6.module+el8.5.0+12205+a865257a
Red Hat:enterprise_linux:8::appstream	redhat	python38	< 0:3.8.16-1.module+el8.8.0+17624+9a09af5a Fix: upgrade to 0:3.8.16-1.module+el8.8.0+17624+9a09af5a
Red Hat:enterprise_linux:8::appstream	redhat	python38-cython	< 0:0.29.14-4.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:0.29.14-4.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::appstream	redhat	python38-cython-debuginfo	< 0:0.29.14-4.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:0.29.14-4.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::appstream	redhat	python38-pymysql	< 0:0.10.1-1.module+el8.4.0+9692+8e86ab84 Fix: upgrade to 0:0.10.1-1.module+el8.4.0+9692+8e86ab84
Red Hat:enterprise_linux:8::appstream	redhat	python38-asn1crypto	< 0:1.2.0-3.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:1.2.0-3.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::appstream	redhat	python38-babel	< 0:2.7.0-11.module+el8.5.0+11015+9c1c7c42 Fix: upgrade to 0:2.7.0-11.module+el8.5.0+11015+9c1c7c42
Red Hat:enterprise_linux:8::appstream	redhat	python38-cffi	< 0:1.13.2-3.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:1.13.2-3.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::appstream	redhat	python38-cffi-debuginfo	< 0:1.13.2-3.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:1.13.2-3.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::appstream	redhat	python38-chardet	< 0:3.0.4-19.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:3.0.4-19.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::appstream	redhat	python38-cryptography	< 0:2.8-3.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:2.8-3.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::appstream	redhat	python38-cryptography-debuginfo	< 0:2.8-3.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:2.8-3.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::appstream	redhat	python38-debug	< 0:3.8.16-1.module+el8.8.0+17624+9a09af5a Fix: upgrade to 0:3.8.16-1.module+el8.8.0+17624+9a09af5a
Red Hat:enterprise_linux:8::appstream	redhat	python38-debuginfo	< 0:3.8.16-1.module+el8.8.0+17624+9a09af5a Fix: upgrade to 0:3.8.16-1.module+el8.8.0+17624+9a09af5a
Red Hat:enterprise_linux:8::appstream	redhat	python38-debugsource	< 0:3.8.16-1.module+el8.8.0+17624+9a09af5a Fix: upgrade to 0:3.8.16-1.module+el8.8.0+17624+9a09af5a
Red Hat:enterprise_linux:8::appstream	redhat	python38-devel	< 0:3.8.16-1.module+el8.8.0+17624+9a09af5a Fix: upgrade to 0:3.8.16-1.module+el8.8.0+17624+9a09af5a
Red Hat:enterprise_linux:8::appstream	redhat	python38-idle	< 0:3.8.16-1.module+el8.8.0+17624+9a09af5a Fix: upgrade to 0:3.8.16-1.module+el8.8.0+17624+9a09af5a
Red Hat:enterprise_linux:8::appstream	redhat	python38-idna	< 0:2.8-6.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:2.8-6.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::appstream	redhat	python38-jinja2	< 0:2.11.3-1.module+el8.7.0+15575+d005caff Fix: upgrade to 0:2.11.3-1.module+el8.7.0+15575+d005caff
Red Hat:enterprise_linux:8::appstream	redhat	python38-libs	< 0:3.8.16-1.module+el8.8.0+17624+9a09af5a Fix: upgrade to 0:3.8.16-1.module+el8.8.0+17624+9a09af5a

Showing 50 of 109. Show the rest

Ecosystem	Vendor	Product	Affected versions
Red Hat:enterprise_linux:8::appstream	redhat	python38-lxml	< 0:4.4.1-7.module+el8.6.0+13958+214a5473 Fix: upgrade to 0:4.4.1-7.module+el8.6.0+13958+214a5473
Red Hat:enterprise_linux:8::appstream	redhat	python38-lxml-debuginfo	< 0:4.4.1-7.module+el8.6.0+13958+214a5473 Fix: upgrade to 0:4.4.1-7.module+el8.6.0+13958+214a5473
Red Hat:enterprise_linux:8::appstream	redhat	python38-markupsafe	< 0:1.1.1-6.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:1.1.1-6.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::appstream	redhat	python38-markupsafe-debuginfo	< 0:1.1.1-6.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:1.1.1-6.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::appstream	redhat	python38-mod_wsgi	< 0:4.6.8-4.module+el8.7.0+16653+23ccaf52 Fix: upgrade to 0:4.6.8-4.module+el8.7.0+16653+23ccaf52
Red Hat:enterprise_linux:8::appstream	redhat	python38-numpy	< 0:1.17.3-6.module+el8.5.0+12205+a865257a Fix: upgrade to 0:1.17.3-6.module+el8.5.0+12205+a865257a
Red Hat:enterprise_linux:8::appstream	redhat	python38-numpy-debuginfo	< 0:1.17.3-6.module+el8.5.0+12205+a865257a Fix: upgrade to 0:1.17.3-6.module+el8.5.0+12205+a865257a
Red Hat:enterprise_linux:8::appstream	redhat	python38-numpy-doc	< 0:1.17.3-6.module+el8.5.0+12205+a865257a Fix: upgrade to 0:1.17.3-6.module+el8.5.0+12205+a865257a
Red Hat:enterprise_linux:8::appstream	redhat	python38-numpy-f2py	< 0:1.17.3-6.module+el8.5.0+12205+a865257a Fix: upgrade to 0:1.17.3-6.module+el8.5.0+12205+a865257a
Red Hat:enterprise_linux:8::appstream	redhat	python38-pip	< 0:19.3.1-6.module+el8.7.0+15823+8950cfa7 Fix: upgrade to 0:19.3.1-6.module+el8.7.0+15823+8950cfa7
Red Hat:enterprise_linux:8::appstream	redhat	python38-pip-wheel	< 0:19.3.1-6.module+el8.7.0+15823+8950cfa7 Fix: upgrade to 0:19.3.1-6.module+el8.7.0+15823+8950cfa7
Red Hat:enterprise_linux:8::appstream	redhat	python38-ply	< 0:3.11-10.module+el8.4.0+9579+e9717e18 Fix: upgrade to 0:3.11-10.module+el8.4.0+9579+e9717e18
Red Hat:enterprise_linux:8::appstream	redhat	python38-psutil	< 0:5.6.4-4.module+el8.5.0+12031+10ce4870 Fix: upgrade to 0:5.6.4-4.module+el8.5.0+12031+10ce4870
Red Hat:enterprise_linux:8::appstream	redhat	python38-psutil-debuginfo	< 0:5.6.4-4.module+el8.5.0+12031+10ce4870 Fix: upgrade to 0:5.6.4-4.module+el8.5.0+12031+10ce4870
Red Hat:enterprise_linux:8::appstream	redhat	python38-psycopg2	< 0:2.8.4-4.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:2.8.4-4.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::appstream	redhat	python38-psycopg2-debuginfo	< 0:2.8.4-4.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:2.8.4-4.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::appstream	redhat	python38-psycopg2-doc	< 0:2.8.4-4.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:2.8.4-4.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::appstream	redhat	python38-psycopg2-tests	< 0:2.8.4-4.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:2.8.4-4.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::appstream	redhat	python38-pycparser	< 0:2.19-3.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:2.19-3.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::appstream	redhat	python38-pysocks	< 0:1.7.1-4.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:1.7.1-4.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::appstream	redhat	python38-pytz	< 0:2019.3-3.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:2019.3-3.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::appstream	redhat	python38-pyyaml	< 0:5.4.1-1.module+el8.5.0+10721+14d8e0d5 Fix: upgrade to 0:5.4.1-1.module+el8.5.0+10721+14d8e0d5
Red Hat:enterprise_linux:8::appstream	redhat	python38-pyyaml-debuginfo	< 0:5.4.1-1.module+el8.5.0+10721+14d8e0d5 Fix: upgrade to 0:5.4.1-1.module+el8.5.0+10721+14d8e0d5
Red Hat:enterprise_linux:8::appstream	redhat	python38-requests	< 0:2.22.0-9.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:2.22.0-9.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::appstream	redhat	python38-rpm-macros	< 0:3.8.16-1.module+el8.8.0+17624+9a09af5a Fix: upgrade to 0:3.8.16-1.module+el8.8.0+17624+9a09af5a
Red Hat:enterprise_linux:8::appstream	redhat	python38-scipy	< 0:1.3.1-4.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:1.3.1-4.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::appstream	redhat	python38-scipy-debuginfo	< 0:1.3.1-4.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:1.3.1-4.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::appstream	redhat	python38-setuptools	< 0:41.6.0-5.module+el8.5.0+12205+a865257a Fix: upgrade to 0:41.6.0-5.module+el8.5.0+12205+a865257a
Red Hat:enterprise_linux:8::appstream	redhat	python38-setuptools-wheel	< 0:41.6.0-5.module+el8.5.0+12205+a865257a Fix: upgrade to 0:41.6.0-5.module+el8.5.0+12205+a865257a
Red Hat:enterprise_linux:8::appstream	redhat	python38-six	< 0:1.12.0-10.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:1.12.0-10.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::appstream	redhat	python38-test	< 0:3.8.16-1.module+el8.8.0+17624+9a09af5a Fix: upgrade to 0:3.8.16-1.module+el8.8.0+17624+9a09af5a
Red Hat:enterprise_linux:8::appstream	redhat	python38-tkinter	< 0:3.8.16-1.module+el8.8.0+17624+9a09af5a Fix: upgrade to 0:3.8.16-1.module+el8.8.0+17624+9a09af5a
Red Hat:enterprise_linux:8::appstream	redhat	python38-urllib3	< 0:1.25.7-5.module+el8.5.0+11639+ea5b349d Fix: upgrade to 0:1.25.7-5.module+el8.5.0+11639+ea5b349d
Red Hat:enterprise_linux:8::appstream	redhat	python38-wheel	< 0:0.33.6-6.module+el8.5.0+12205+a865257a Fix: upgrade to 0:0.33.6-6.module+el8.5.0+12205+a865257a
Red Hat:enterprise_linux:8::appstream	redhat	python38-wheel-wheel	< 0:0.33.6-6.module+el8.5.0+12205+a865257a Fix: upgrade to 0:0.33.6-6.module+el8.5.0+12205+a865257a
Red Hat:enterprise_linux:8::appstream	redhat	python3x-pip	< 0:19.3.1-6.module+el8.7.0+15823+8950cfa7 Fix: upgrade to 0:19.3.1-6.module+el8.7.0+15823+8950cfa7
Red Hat:enterprise_linux:8::appstream	redhat	python3x-setuptools	< 0:41.6.0-5.module+el8.5.0+12205+a865257a Fix: upgrade to 0:41.6.0-5.module+el8.5.0+12205+a865257a
Red Hat:enterprise_linux:8::appstream	redhat	python3x-six	< 0:1.12.0-10.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:1.12.0-10.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::appstream	redhat	pytz	< 0:2019.3-3.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:2019.3-3.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::appstream	redhat	scipy	< 0:1.3.1-4.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:1.3.1-4.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::appstream	redhat	scipy-debugsource	< 0:1.3.1-4.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:1.3.1-4.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::crb	redhat	pytest	< 0:4.6.6-3.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:4.6.6-3.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::crb	redhat	python-atomicwrites	< 0:1.3.0-8.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:1.3.0-8.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::crb	redhat	python-attrs	< 0:19.3.0-3.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:19.3.0-3.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::crb	redhat	python-more-itertools	< 0:7.2.0-5.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:7.2.0-5.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::crb	redhat	python-packaging	< 0:19.2-3.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:19.2-3.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::crb	redhat	python-pluggy	< 0:0.13.0-3.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:0.13.0-3.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::crb	redhat	python-py	< 0:1.8.0-8.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:1.8.0-8.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::crb	redhat	python-wcwidth	< 0:0.1.7-16.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:0.1.7-16.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::crb	redhat	python38-atomicwrites	< 0:1.3.0-8.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:1.3.0-8.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::crb	redhat	python38-attrs	< 0:19.3.0-3.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:19.3.0-3.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::crb	redhat	python38-more-itertools	< 0:7.2.0-5.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:7.2.0-5.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::crb	redhat	python38-packaging	< 0:19.2-3.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:19.2-3.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::crb	redhat	python38-pluggy	< 0:0.13.0-3.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:0.13.0-3.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::crb	redhat	python38-py	< 0:1.8.0-8.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:1.8.0-8.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::crb	redhat	python38-pyparsing	< 0:2.4.5-3.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:2.4.5-3.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::crb	redhat	python38-pytest	< 0:4.6.6-3.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:4.6.6-3.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::crb	redhat	python38-wcwidth	< 0:0.1.7-16.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:0.1.7-16.module+el8.4.0+8888+89bc7e79
Red Hat:enterprise_linux:8::crb	redhat	python3x-pyparsing	< 0:2.4.5-3.module+el8.4.0+8888+89bc7e79 Fix: upgrade to 0:2.4.5-3.module+el8.4.0+8888+89bc7e79

Original advisory text

Red Hat Security Advisory: python38:3.8 and python38-devel:3.8 security update

References

https://access.redhat.com/errata/RHSA-2023:2763 Vendor Advisory
https://access.redhat.com/security/updates/classification/#moderate Third Party Advisory
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.... Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1834423 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2120642 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2144072 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2763.j... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2020-10735 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2020-10735 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-10735 Vendor Advisory
https://github.com/python/cpython/pull/96499 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2021-28861 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2021-28861 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-28861 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2022-45061 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2022-45061 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-45061 Vendor Advisory
https://github.com/python/cpython/issues/98433 Third Party Advisory
https://python-security.readthedocs.io/vuln/slow-idna-large-strings.html Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Timeline

Published13 Sep 2024

Updated8 Oct 2026

First seen8 Oct 2026

Sources

RHSA-2023:2763 · OSV

Track software like this

Free during beta