SB2024062621 - Gentoo update for Python, PyPy3

Description

This security bulletin contains information about 6 secuirty vulnerabilities.

1) Improper input validation (CVE-ID: CVE-2023-6507)

The vulnerability allows a remote privileged user to manipulate data.

The vulnerability exists due to improper input validation within the Third Party (Python) component in Oracle Communications Cloud Native Core Network Data Analytics Function. A remote privileged user can exploit this vulnerability to manipulate data.

2) UNIX symbolic link following (CVE-ID: CVE-2023-6597)

The vulnerability allows a local user to delete arbitrary files on the system.

The vulnerability exists due to a symlink following issue during cleanup when handling temporary files. A local user can create a specially crafted symbolic link to a critical file on the system and delete it.

3) Input validation error (CVE-ID: CVE-2023-24329)

The vulnerability allows a remote attacker to bypass implemented filters.

The vulnerability exists due to insufficient validation of URLs that start with blank characters within urllib.parse component of Python. A remote attacker can pass specially crafted URL to bypass existing filters.

4) Cleartext transmission of sensitive information (CVE-ID: CVE-2023-40217)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to an error in ssl.SSLSocket implementation when handling TLS client authentication. A remote attacker can trick the application to send data unencrypted.

5) Path traversal (CVE-ID: CVE-2023-41105)

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.

6) Resource exhaustion (CVE-ID: CVE-2024-0450)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the zipfile module does not properly control consumption of internal resources when extracting files from a zip archive. A remote attacker can pass a specially crafted archive aka zip-bomb to the application, trigger resource exhaustion and perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://security.gentoo.org/glsa/202405-01