1. Forum
  2. Usenet
  3. LINUX.GENTOO.ANNOUNCE

  • [gentoo-announce] [ GLSA 202405-01 ] Python, PyPy3: Multiple Vulnerabil

    From glsamaker@gentoo.org@21:1/5 to All on Sat May 4 08:10:01 2024
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Gentoo Linux Security Advisory GLSA 202405-01
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    https://security.gentoo.org/
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Severity: High
    Title: Python, PyPy3: Multiple Vulnerabilities
    Date: May 04, 2024
    Bugs: #884653, #897958, #908018, #912976, #919475, #927299
    ID: 202405-01

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Synopsis
    ========

    Multiple vulberabilities have been discovered in Python and PyPy3, the
    worst of which can lead to privilege escalation.

    Background
    ==========

    Python is an interpreted, interactive, object-oriented, cross-platform programming language.

    Affected packages
    =================

    Package Vulnerable Unaffected
    ------------------- -------------- ---------------
    dev-lang/python < 3.10.14:3.10 >= 3.10.14:3.10
    < 3.11.8:3.11 >= 3.11.8:3.11
    < 3.12.1:3.12 >= 3.12.1:3.12
    < 3.8.19:3.8 >= 3.8.19:3.8
    < 3.9.19:3.9 >= 3.9.19:3.9
    dev-python/pypy3 < 7.3.16 >= 7.3.16
    dev-python/pypy3_10 < 7.3.16 >= 7.3.16
    dev-python/pypy3_9 < 7.3.16 >= 7.3.16

    Description
    ===========

    Multiple vulnerabilities have been discovered in Python, PyPy3. Please
    review the CVE identifiers referenced below for details.

    Impact
    ======

    Please review the referenced CVE identifiers for details.

    Workaround
    ==========

    There is no known workaround at this time.

    Resolution
    ==========

    All Python, PyPy3 users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=dev-lang/python-3.12.1:3.12"
    # emerge --ask --oneshot --verbose ">=dev-lang/python-3.11.9:3.11"
    # emerge --ask --oneshot --verbose ">=dev-lang/python-3.10.14:3.10"
    # emerge --ask --oneshot --verbose ">=dev-lang/python-3.9.19:3.9"
    # emerge --ask --oneshot --verbose ">=dev-lang/python-3.8.19:3.8"
    # emerge --ask --oneshot --verbose ">=dev-python/pypy3-7.3.16"
    # emerge --ask --oneshot --verbose ">=dev-python/pypy3_10-7.3.16"
    # emerge --ask --oneshot --verbose ">=dev-python/pypy3_9-7.3.16"

    References
    ==========

    [ 1 ] CVE-2023-6507
    https://nvd.nist.gov/vuln/detail/CVE-2023-6507
    [ 2 ] CVE-2023-6597
    https://nvd.nist.gov/vuln/detail/CVE-2023-6597
    [ 3 ] CVE-2023-24329
    https://nvd.nist.gov/vuln/detail/CVE-2023-24329
    [ 4 ] CVE-2023-40217
    https://nvd.nist.gov/vuln/detail/CVE-2023-40217
    [ 5 ] CVE-2023-41105
    https://nvd.nist.gov/vuln/detail/CVE-2023-41105
    [ 6 ] CVE-2024-0450
    https://nvd.nist.gov/vuln/detail/CVE-2024-0450

    Availability
    ============

    This GLSA and any updates to it are available for viewing at
    the Gentoo Security Website:

    https://security.gentoo.org/glsa/202405-01

    Concerns?
    =========

    Security is a primary focus of Gentoo Linux and ensuring the
    confidentiality and security of our users' machines is of utmost
    importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

    License
    =======

    Copyright 2024 Gentoo Foundation, Inc; referenced text
    belongs to its owner(s).

    The contents of this document are licensed under the
    Creative Commons - Attribution / Share Alike license.

    https://creativecommons.org/licenses/by-sa/2.5
    -----BEGIN PGP SIGNATURE-----

    iQIzBAEBCgAdFiEEpqTA6ABLMxh/aChGFMQkOaVy+9kFAmY1zygACgkQFMQkOaVy +9nQuBAAuS4PCJu6oDQNnNvtY36KawwlYqZsFV6UHQofM49arbnbZ5/l/rDeCCyG 8CBZgTItUpWmhYIonj7DqmJkSTjgiZ6kHsBMtXHTPCUeyg9BdlU8LporHfPwFzxE EFPrD2+PaTjTgM4y7BO8N6D/zKARh0o3M7gGc6I4wZwZqO7cdhEnrXSaSIjY+mRY CB3fqj85ORopIHE/eGbfxdcarkmleZOijqKucDHoMsZIAYzCC38Ns44WM7rQPgfv aH+QJMY/WblpIRDQwbXY7p4t4gKJB6UDUwlnPRz31KtvxhVF7xeBI5eEw19zKfvB kd4dEJpzTjizbpD7TCs++OP0tUpcu1IMao6QV1CdBPDJx/KT9BnRTvbB2vq1Be5A TQGU3qKp/bKhplotPA7Aw/EzxCc/dagiKCndnEBqb9WEp+n96V8wCMEfsenzVfXG XZxBlYHdF5MTq1SJqeHzgIok6q3tEOlUQWXixDsadE1p0Fbn9gPoS3dR1aDiKXSN O4w+RxRiGazHWGmi1GWkNu0L1m7gLKLyN0DhfQYamlmWs88YOH77LzqrYngP3EVo RARTNET7euzSRhuUBcW8L7caVT9ZdVV3NpUzk6OL2WgpbOdV3YzJhJWAaEmeqtGa EpGNMQBsTwD+0JcFE52bJpjWRkFJPvUGzowpkP141kia/8EtOH8=
    =kgRQ
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)