• [gentoo-announce] [ GLSA 202305-02 ] Python, PyPy3: Multiple Vulnerabil

    From glsamaker@gentoo.org@21:1/5 to All on Wed May 3 11:30:01 2023
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Gentoo Linux Security Advisory GLSA 202305-02
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    https://security.gentoo.org/
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Severity: High
    Title: Python, PyPy3: Multiple Vulnerabilities
    Date: May 03, 2023
    Bugs: #880629, #878385, #877851, #876815, #864747, #838250, #835443, #834533, #787260, #811165, #793833
    ID: 202305-02

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Synopsis
    ========

    Multiple vulnerabilities have been found in Python and PyPy, the worst
    of which could result in arbitrary code execution.

    Background
    ==========

    Python is an interpreted, interactive, object-oriented, cross-platform programming language.

    Affected packages
    =================

    -------------------------------------------------------------------
    Package / Vulnerable / Unaffected
    ------------------------------------------------------------------- Traceback (most recent call last):
    File "/usr/local/lib/python3.9/site-packages/glsamaker/models/glsa.py", line 326, in generate_mail_table
    return self._generate_mail_table()
    File "/usr/local/lib/python3.9/site-packages/glsamaker/models/glsa.py", line 252, in _generate_mail_table
    ret[line_idx] += chunk.rjust(
    IndexError: list index out of range


    Description
    ===========

    Multiple vulnerabilities have been discovered in Python and PyPy3.
    Please review the CVE identifiers referenced below for details.

    Impact
    ======

    Please review the referenced CVE identifiers for details.

    Workaround
    ==========

    There is no known workaround at this time.

    Resolution
    ==========

    All Python 3.8 users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=dev-lang/python-3.8.15_p3:3.8"

    All Python 3.9 users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=dev-lang/python-3.9.15_p3:3.9"

    All Python 3.10 users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=dev-lang/python-3.10.8_p3:3.10"

    All Python 3.11 users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=dev-lang/python-3.11.0_p2:3.11"

    All Python 3.12 users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=dev-lang/python-3.12.0_alpha1_p2"

    All PyPy3 users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=dev-python/pypy3-7.3.9_p9"

    References
    ==========

    [ 1 ] CVE-2015-20107
    https://nvd.nist.gov/vuln/detail/CVE-2015-20107
    [ 2 ] CVE-2021-3654
    https://nvd.nist.gov/vuln/detail/CVE-2021-3654
    [ 3 ] CVE-2021-28363
    https://nvd.nist.gov/vuln/detail/CVE-2021-28363
    [ 4 ] CVE-2021-28861
    https://nvd.nist.gov/vuln/detail/CVE-2021-28861
    [ 5 ] CVE-2021-29921
    https://nvd.nist.gov/vuln/detail/CVE-2021-29921
    [ 6 ] CVE-2022-0391
    https://nvd.nist.gov/vuln/detail/CVE-2022-0391
    [ 7 ] CVE-2022-37454
    https://nvd.nist.gov/vuln/detail/CVE-2022-37454
    [ 8 ] CVE-2022-42919
    https://nvd.nist.gov/vuln/detail/CVE-2022-42919
    [ 9 ] CVE-2022-45061
    https://nvd.nist.gov/vuln/detail/CVE-2022-45061

    Availability
    ============

    This GLSA and any updates to it are available for viewing at
    the Gentoo Security Website:

    https://security.gentoo.org/glsa/202305-02

    Concerns?
    =========

    Security is a primary focus of Gentoo Linux and ensuring the
    confidentiality and security of our users' machines is of utmost
    importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

    License
    =======

    Copyright 2023 Gentoo Foundation, Inc; referenced text
    belongs to its owner(s).

    The contents of this document are licensed under the
    Creative Commons - Attribution / Share Alike license.

    https://creativecommons.org/licenses/by-sa/2.5
    -----BEGIN PGP SIGNATURE-----

    iQIzBAEBCgAdFiEEpqTA6ABLMxh/aChGFMQkOaVy+9kFAmRSJZUACgkQFMQkOaVy +9kPUhAAnNRocAM0317Y2xn16JjZ7ElYHIj3/G52IU729lH/6bSxBIUkhpqMs71T BTSeY/J143xNgCKZdqSS8YWu0D+PbehWU19VYYaMj1cqsOy6hBiLg4SC/D2cZKB4 J3s/EVuqnueS6fArjr9mbr76BkQ1Ag+IGFBKCct6v/iKWGs9cIr0HZ98pWu+puyZ +G50kUhZDCaMcj7NeUz8a2OE00vCYrDQagxobKaR64R1MjB2WAvXPMUDT6J/dycJ G/s6QOo2XuKXSSY0LxLVSy5duT1RYOVIDBgBLBIo1pxbnXta4SVN1E7e+MZ8OSfy /sS3BzKw8w7LNzEL74E4frhrlUuLapatgGxRoGTtEnmlxZPEHZh4p+caeTuQv5Ry MmVHTP1+UDbcPl0aEwp5rtq4iVu8T7Yb7NbYJeC2Jxl0Hw6ssJpHl/FCVhifZp+H SEBblaYPQ5RI+sBIQrOc4RB89yQlB4Uc0rO+G0Dsn11cqyzq+KpbLuuyT8CBdCFz Khmct+tXfloRTS/Uc5DH+XTJ3fivBIwhqMQehjUiULZFWDhjPSgEh0XBXsoinCmI X1ut0YMw8fTx491g4E1fvbVaYcnX71GpW1ZiftA/FUp89tsTI62L7yhJ9/9w/vho fE7qoVOFXn+3fjd+9rCP4c0bDrVgH7iS8V0ng3CattKoGf1vjWw=
    =pJwo
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Sam James@21:1/5 to All on Thu May 4 09:30:01 2023
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Gentoo Linux Security Advisory GLSA 202305-02
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    https://security.gentoo.org/
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Severity: High
    Title: Python, PyPy3: Multiple Vulnerabilities
    Date: May 03, 2023
    Bugs: #880629, #878385, #877851, #876815, #864747, #838250, #835443, #834533, #787260, #811165, #793833
    ID: 202305-02

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Synopsis
    ========

    Multiple vulnerabilities have been found in Python and PyPy, the worst
    of which could result in arbitrary code execution.

    Background
    ==========

    Python is an interpreted, interactive, object-oriented, cross-platform programming language.

    Affected packages
    =================

    -------------------------------------------------------------------
    Package / Vulnerable / Unaffected
    -------------------------------------------------------------------
    dev-lang/python:3.8 <3.8.15_p3:3.8 >=3.8.15_p3:3.8
    dev-lang/python:3.9 <3.9.15_p3:3.9 >=3.9.15_p3:3.9
    dev-lang/python:3.10 <3.10.8_p3:3.10 >=3.10.8_p3:3.10
    dev-lang/python:3.11 <3.11.0_p2:3.11 >=3.11.0_p2:3.11
    dev-lang/python:3.12 <3.12.0_alpha1_p2:3.12 >=3.12.0_alpha1_p2:3.12
    dev-lang/pypy3 <7.3.9_p9 >=7.3.9_p9

    Description
    ===========

    Multiple vulnerabilities have been discovered in Python and PyPy3.
    Please review the CVE identifiers referenced below for details.

    Impact
    ======

    Please review the referenced CVE identifiers for details.

    Workaround
    ==========

    There is no known workaround at this time.

    Resolution
    ==========

    All Python 3.8 users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=dev-lang/python-3.8.15_p3:3.8"

    All Python 3.9 users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=dev-lang/python-3.9.15_p3:3.9"

    All Python 3.10 users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=dev-lang/python-3.10.8_p3:3.10"

    All Python 3.11 users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=dev-lang/python-3.11.0_p2:3.11"

    All Python 3.12 users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=dev-lang/python-3.12.0_alpha1_p2"

    All PyPy3 users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=dev-python/pypy3-7.3.9_p9"

    References
    ==========

    [ 1 ] CVE-2015-20107
    https://nvd.nist.gov/vuln/detail/CVE-2015-20107
    [ 2 ] CVE-2021-3654
    https://nvd.nist.gov/vuln/detail/CVE-2021-3654
    [ 3 ] CVE-2021-28363
    https://nvd.nist.gov/vuln/detail/CVE-2021-28363
    [ 4 ] CVE-2021-28861
    https://nvd.nist.gov/vuln/detail/CVE-2021-28861
    [ 5 ] CVE-2021-29921
    https://nvd.nist.gov/vuln/detail/CVE-2021-29921
    [ 6 ] CVE-2022-0391
    https://nvd.nist.gov/vuln/detail/CVE-2022-0391
    [ 7 ] CVE-2022-37454
    https://nvd.nist.gov/vuln/detail/CVE-2022-37454
    [ 8 ] CVE-2022-42919
    https://nvd.nist.gov/vuln/detail/CVE-2022-42919
    [ 9 ] CVE-2022-45061
    https://nvd.nist.gov/vuln/detail/CVE-2022-45061

    Availability
    ============

    This GLSA and any updates to it are available for viewing at
    the Gentoo Security Website:

    https://security.gentoo.org/glsa/202305-02

    Concerns?
    =========

    Security is a primary focus of Gentoo Linux and ensuring the
    confidentiality and security of our users' machines is of utmost
    importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

    License
    =======

    Copyright 2023 Gentoo Foundation, Inc; referenced text
    belongs to its owner(s).

    The contents of this document are licensed under the
    Creative Commons - Attribution / Share Alike license.

    https://creativecommons.org/licenses/by-sa/2.5


    --=-=-Content-Type: application/pgp-signature; name="signature.asc"

    -----BEGIN PGP SIGNATURE-----

    iOUEARYKAI0WIQQlpruI3Zt2TGtVQcJzhAn1IN+RkAUCZFNZBF8UgAAAAAAuAChp c3N1ZXItZnByQG5vdGF0aW9ucy5vcGVucGdwLmZpZnRoaG9yc2VtYW4ubmV0MjVB NkJCODhERDlCNzY0QzZCNTU0MUMyNzM4NDA5RjUyMERGOTE5MA8cc2FtQGdlbnRv by5vcmcACgkQc4QJ9SDfkZCAlgD/RCtOnfv3WJYpwGtdDbJLIoojQ5YzDpd7FWOT vuoJyB4A/1wKyXJTXYCN9eMKQ6H9lb7sfGJEI3SYhqCVHfYC8kgC
    !im
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)