python3.12-3.12.5-2.el8_10
エラータID: AXSA:2024-8842:07
リリース日:
2024/09/26 Thursday - 15:18
題名:
python3.12-3.12.5-2.el8_10
影響のあるチャネル:
Asianux Server 8 for x86_64
Severity:
Moderate
Description:
以下項目について対処しました。
[Security Fix]
- Python の ipaddress モジュールには、特定の IPv4 および
IPv6 アドレスがプライベートアドレスかどうかに関する誤った
情報が設定されていること起因して、IANA 特殊用途アドレス
レジストリからの最新情報に沿った値が返されない問題がある
ため、リモートの攻撃者により、サービス拒否攻撃を可能と
する脆弱性が存在します。(CVE-2024-4032)
- CPython の email モジュールには、電子メールをシリアル化
する際のヘッダー部の改行の処理に問題があるため、リモート
の攻撃者により、不正なヘッダーの挿入を可能とする脆弱性が
存在します。(CVE-2024-6923)
- CPython の zipfile モジュールの zipfile.ZipFile 内の各メソッド
には、アーカイブ内のエントリの反復処理において無限ループ
の発生に至る問題があるため、リモートの攻撃者により、細工
された ZIP 形式のアーカイブファイルの読み取りを介して、
サービス拒否攻撃を可能とする脆弱性が存在します。
(CVE-2024-8088)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2024-4032
The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the is_private and is_global properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network classes, where values wouldn’t be returned in accordance with the latest information from the IANA Special-Purpose Address Registries. CPython 3.12.4 and 3.13.0a6 contain updated information from these registries and thus have the intended behavior.
The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the is_private and is_global properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network classes, where values wouldn’t be returned in accordance with the latest information from the IANA Special-Purpose Address Registries. CPython 3.12.4 and 3.13.0a6 contain updated information from these registries and thus have the intended behavior.
CVE-2024-6923
There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized.
There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized.
CVE-2024-8088
There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class is unaffected. When iterating over names of entries in a zip archive (for example, methods of "zipfile.Path" like "namelist()", "iterdir()", etc) the process can be put into an infinite loop with a maliciously crafted zip archive. This defect applies when reading only metadata or extracting the contents of the zip archive. Programs that are not handling user-controlled zip archives are not affected.
There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class is unaffected. When iterating over names of entries in a zip archive (for example, methods of "zipfile.Path" like "namelist()", "iterdir()", etc) the process can be put into an infinite loop with a maliciously crafted zip archive. This defect applies when reading only metadata or extracting the contents of the zip archive. Programs that are not handling user-controlled zip archives are not affected.
追加情報:
N/A
ダウンロード:
SRPMS
- python3.12-3.12.5-2.el8_10.src.rpm
MD5: ef059bcc9ca9d279e1bd82d419ed3a06
SHA-256: dd4f1891b442edfebfd9aaa9980b5d7e46dbdadad7a414f53de9e76effe2ee2e
Size: 19.55 MB
Asianux Server 8 for x86_64
- python3.12-3.12.5-2.el8_10.i686.rpm
MD5: 334ea250277b8e2f5117516324cb7f3d
SHA-256: 080835a5c74dd066a9c0185b008a2a4d391086390c1b68237661961b75ec50fc
Size: 29.35 kB - python3.12-3.12.5-2.el8_10.x86_64.rpm
MD5: 9c8f4d0cdfaa3e908e454a55e2bd30dd
SHA-256: 803a6ae43a25d9e939093d46dff3964a94ddcf98b49b8396495efeea3c7b8818
Size: 29.27 kB - python3.12-debug-3.12.5-2.el8_10.i686.rpm
MD5: e0c89773a24aaff18113acdd15341453
SHA-256: 0bfd67b33e8ba976c7aad607fa084ff6b1bfd66a7fbc87f444647ff03aec3c1d
Size: 3.47 MB - python3.12-debug-3.12.5-2.el8_10.x86_64.rpm
MD5: 0ca3700b446d8213cee539e37a758265
SHA-256: 894928ffa196e226484e0f3462207ce9f7dce61bb0d969f5180f5f9c179ccb1f
Size: 3.66 MB - python3.12-devel-3.12.5-2.el8_10.i686.rpm
MD5: ac47d5be741cc14866092b556f580788
SHA-256: e595b8234695401b06a97e14da644314691cfbb0c4a2f8119c832f88f30c066f
Size: 289.46 kB - python3.12-devel-3.12.5-2.el8_10.x86_64.rpm
MD5: 5de34b0c3bd84f71edae1eeb7f83a28c
SHA-256: 9d82f68237d974ea6f1c82c6599e860d8f0fa2f4967819b5886320ddc53f6bef
Size: 289.36 kB - python3.12-idle-3.12.5-2.el8_10.i686.rpm
MD5: e387323833bdaa248fcea3f25f706a6f
SHA-256: df09366f81c43590593088c4d7330ebabaec3660bcb6d7b346fc66ed45aaebad
Size: 1.29 MB - python3.12-idle-3.12.5-2.el8_10.x86_64.rpm
MD5: e01a10af10729097f6385211d14c8658
SHA-256: 7cf9806e6aa41d696352296efbb75a63bf275adb2ab8286f3dad2d2ea07bf3e3
Size: 1.29 MB - python3.12-libs-3.12.5-2.el8_10.i686.rpm
MD5: aabca2afc8e39e4a5a4c395a7af0f23a
SHA-256: 4b33f14b7d8beb4c49aeacf3126765ef65ed827d6430a1af32c1397f7d9163cb
Size: 10.06 MB - python3.12-libs-3.12.5-2.el8_10.x86_64.rpm
MD5: 2a64f82216e288914c19c5bf5151a763
SHA-256: 0cef944a106cb801420e729dd27dbcf71fab941b2508e57e5f22f4f7abefac1f
Size: 9.98 MB - python3.12-rpm-macros-3.12.5-2.el8_10.noarch.rpm
MD5: 12ce5eeb29366d744665dfe543bfb791
SHA-256: 2e866894716ac843e749a516ac95bcb8c024dce12861e3122cc0934fcefc51d9
Size: 15.69 kB - python3.12-test-3.12.5-2.el8_10.i686.rpm
MD5: ced8a09c4b32247c21a3df617928e497
SHA-256: 88416aae4942505ce7d7d035b31d7fd70fb80c8d33a06479b6f730db54d1e68c
Size: 15.80 MB - python3.12-test-3.12.5-2.el8_10.x86_64.rpm
MD5: 70d29f3bcc8dcd503038192958fbe6cb
SHA-256: ff09e359983547f68064b3598b0d4c93713440db22562c6f791c6c9e293a8787
Size: 15.79 MB - python3.12-tkinter-3.12.5-2.el8_10.i686.rpm
MD5: f128573157d33df5a45316698da4b51f
SHA-256: 7ec557c463ff6e188133295a510d12cbe34c927c47e7ae360f23c5093e61988e
Size: 401.74 kB - python3.12-tkinter-3.12.5-2.el8_10.x86_64.rpm
MD5: 24b1486cd241f5c272fbe9cd6f19033f
SHA-256: 72d8182f204add65bf22071d2d4048a532c7d18b10e5031d11ecb4a00aee3984
Size: 400.48 kB
English