This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Python fixes several vulnerabilities

Python fixes several vulnerabilities in versions 3.13.0RC2, 3.12.6, 3.11.10, 3.10.15, 3.9.20, and 3.8.20, several of which have no CVE identifier assigned [1]. The most severe vulnerabilities are listed below. So far, Slackware has fixed the vulnerabilities [2]. Debian and Ubuntu have fixed only some of the vulnerabilities in some releases. Gentoo has some fixed versions available in the stable branch and some in the testing branch [3].

Python - wrong IP type (CVE-2024-4032)
CVSS 7.5 (High)

An unauthenticated remote attacker can impersonate a private or global IP address without authorization [1].

The vulnerability is present in product:

  • Python; >=3.12, <3.12.6; >=3.11, <3.11.10; >=3.10, <3.10.15; >=3.9, <3.9.20; >=3.8, <3.8.20;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

More information:

The vulnerability was publicly disclosed 7. 9. 2024.

Python - incorrect directory permissions (CVE-2024-4030)
CVSS 7.1 (High)

An authenticated local attacker can obtain elevated permissions to directories. The vulnerability is exploitable only on Windows systems and only if the location of the temporary directory has been changed [1][4].

The vulnerability is present in product:

  • Python; >=3.12, <3.12.6; >=3.11, <3.11.10; >=3.10, <3.10.15; >=3.9, <3.9.20; >=3.8, <3.8.20;

CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

More information:

The vulnerability was publicly disclosed 7. 9. 2024.

Python - type confusion

An authenticated local attacker can access memory without authorization, which may lead to data corruption, unauthorized reading of information, a DoS attack and potentially code execution [1].

The vulnerability is present in product:

  • Python; >=3.12, <3.12.6; >=3.11, <3.11.10; >=3.10, <3.10.15; >=3.9, <3.9.20; >=3.8, <3.8.20;

More information:

  • CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') at cwe.mitre.org

The vulnerability was publicly disclosed 7. 9. 2024.

By CESNET, z.s.p.o. Martin Krajči on 16. 9. 2024.

CESNET, z.s.p.o. Logo