Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
AlmaLinux Python 3.11 may misinterpret network ranges and email headers
published 2 years ago
Summary
Python 3.11 packages from AlmaLinux can incorrectly treat certain private IP addresses as public and may allow crafted email messages to add unwanted header lines. This could let attackers bypass network‑based controls or tamper with email content. Apply the latest Python 3.11 update from AlmaLinux to fix the problem.
What to do
- Update almalinux python3.11 to version 3.11.9-7.el8_10.
- Update almalinux python3.11-debug to version 3.11.9-7.el8_10.
- Update almalinux python3.11-devel to version 3.11.9-7.el8_10.
- Update almalinux python3.11-idle to version 3.11.9-7.el8_10.
- Update almalinux python3.11-libs to version 3.11.9-7.el8_10.
- Update almalinux python3.11-rpm-macros to version 3.11.9-7.el8_10.
- Update almalinux python3.11-test to version 3.11.9-7.el8_10.
- Update almalinux python3.11-tkinter to version 3.11.9-7.el8_10.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:8 | almalinux | python3.11 |
< 3.11.9-7.el8_10 Fix: upgrade to 3.11.9-7.el8_10
|
| AlmaLinux:8 | almalinux | python3.11-debug |
< 3.11.9-7.el8_10 Fix: upgrade to 3.11.9-7.el8_10
|
| AlmaLinux:8 | almalinux | python3.11-devel |
< 3.11.9-7.el8_10 Fix: upgrade to 3.11.9-7.el8_10
|
| AlmaLinux:8 | almalinux | python3.11-idle |
< 3.11.9-7.el8_10 Fix: upgrade to 3.11.9-7.el8_10
|
| AlmaLinux:8 | almalinux | python3.11-libs |
< 3.11.9-7.el8_10 Fix: upgrade to 3.11.9-7.el8_10
|
| AlmaLinux:8 | almalinux | python3.11-rpm-macros |
< 3.11.9-7.el8_10 Fix: upgrade to 3.11.9-7.el8_10
|
| AlmaLinux:8 | almalinux | python3.11-test |
< 3.11.9-7.el8_10 Fix: upgrade to 3.11.9-7.el8_10
|
| AlmaLinux:8 | almalinux | python3.11-tkinter |
< 3.11.9-7.el8_10 Fix: upgrade to 3.11.9-7.el8_10
|
Original advisory text
Moderate: python3.11 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Security Fix(es):
* python: incorrect IPv4 and IPv6 private ranges (CVE-2024-4032)
* cpython: python: email module doesn't properly quotes newlines in email headers, allowing header injection (CVE-2024-6923)
* python: cpython: From NVD collector (CVE-2024-8088)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* python: incorrect IPv4 and IPv6 private ranges (CVE-2024-4032)
* cpython: python: email module doesn't properly quotes newlines in email headers, allowing header injection (CVE-2024-6923)
* python: cpython: From NVD collector (CVE-2024-8088)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://access.redhat.com/errata/RHSA-2024:6962 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2024-4032 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2024-6923 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2024-8088 Third Party Advisory
- https://bugzilla.redhat.com/2292921 Third Party Advisory
- https://bugzilla.redhat.com/2302255 Third Party Advisory
- https://bugzilla.redhat.com/2307370 Third Party Advisory
- https://errata.almalinux.org/8/ALSA-2024-6962.html Vendor Advisory
Timeline
Published24 Sep 2024
Updated29 Oct 2026
First seen29 Oct 2026
Sources
ALSA-2024:6962 · OSV
Track software like this
Free during beta