rpm package
almalinux/python3.11-idle
pkg:rpm/almalinux/python3.11-idle
Vulnerabilities (29)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2024-6923 | Med | 5.5 | < 3.11.7-1.el9_4.5 | 3.11.7-1.el9_4.5 | Aug 1, 2024 | There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized. | |
| CVE-2024-4032 | Hig | 7.5 | < 3.11.7-1.el9_4.3 | 3.11.7-1.el9_4.3 | Jun 17, 2024 | The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the is_private and is_global properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Addr | |
| CVE-2024-0450 | Med | 6.2 | < 3.11.9-1.el8_10 | 3.11.9-1.el8_10 | Mar 19, 2024 | An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The zipfile module is vulnerable to “quoted-overlap” zip-bombs which exploit the zip format to create a zip-bomb with a high compression ratio. The fixed | |
| CVE-2023-6597 | Hig | 7.8 | < 3.11.9-1.el8_10 | 3.11.9-1.el8_10 | Mar 19, 2024 | An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference symlinks during cleanup of permissions-related errors. This means users which c | |
| CVE-2023-40217 | — | < 3.11.2-2.el9_2.2 | 3.11.2-2.el9_2.2 | Aug 25, 2023 | An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If a TLS server-side socket is created, receives data into the socket buf | ||
| CVE-2023-41105 | — | < 3.11.5-1.el9_3 | 3.11.5-1.el9_3 | Aug 23, 2023 | An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.normpath(), the path will be truncated unexpectedly at the first '\0' byte. There are plausible cases in which an application would have rejected a filename for security re | ||
| CVE-2023-27043 | Med | 5.3 | < 3.11.7-1.el9 | 3.11.7-1.el9 | Apr 19, 2023 | The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which applica | |
| CVE-2023-24329 | — | < 3.11.2-2.el9_2.1 | 3.11.2-2.el9_2.1 | Feb 17, 2023 | An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters. | ||
| CVE-2007-4559 | Cri | 9.8 | < 3.11.5-1.el9_3 | 3.11.5-1.el9_3 | Aug 28, 2007 | Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267. |
- affected < 3.11.7-1.el9_4.5fixed 3.11.7-1.el9_4.5
There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized.
- affected < 3.11.7-1.el9_4.3fixed 3.11.7-1.el9_4.3
The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the is_private and is_global properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Addr
- affected < 3.11.9-1.el8_10fixed 3.11.9-1.el8_10
An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The zipfile module is vulnerable to “quoted-overlap” zip-bombs which exploit the zip format to create a zip-bomb with a high compression ratio. The fixed
- affected < 3.11.9-1.el8_10fixed 3.11.9-1.el8_10
An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference symlinks during cleanup of permissions-related errors. This means users which c
- CVE-2023-40217Aug 25, 2023affected < 3.11.2-2.el9_2.2fixed 3.11.2-2.el9_2.2
An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If a TLS server-side socket is created, receives data into the socket buf
- CVE-2023-41105Aug 23, 2023affected < 3.11.5-1.el9_3fixed 3.11.5-1.el9_3
An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.normpath(), the path will be truncated unexpectedly at the first '\0' byte. There are plausible cases in which an application would have rejected a filename for security re
- affected < 3.11.7-1.el9fixed 3.11.7-1.el9
The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which applica
- CVE-2023-24329Feb 17, 2023affected < 3.11.2-2.el9_2.1fixed 3.11.2-2.el9_2.1
An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.
- affected < 3.11.5-1.el9_3fixed 3.11.5-1.el9_3
Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267.
Page 2 of 2