Ubuntu alert USN-7348-1 (python3.5, python3.8)
| From: | Fabian Toepfer <fabian.toepfer@canonical.com> | |
| To: | ubuntu-security-announce@lists.ubuntu.com | |
| Subject: | [USN-7348-1] Python vulnerabilities | |
| Date: | Wed, 12 Mar 2025 15:41:39 +0100 | |
| Message-ID: | <8aabfe0f-a03c-43d1-99a1-a6752bddc94b@canonical.com> |
========================================================================== Ubuntu Security Notice USN-7348-1 March 12, 2025 python3.5, python3.8 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 20.04 LTS - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS Summary: Several security issues were fixed in Python. Software Description: - python3.8: An interactive high-level object-oriented language - python3.5: An interactive high-level object-oriented language Details: It was discovered that the Python ipaddress module contained incorrect information about which IP address ranges were considered “private” or “globally reachable”. This could possibly result in applications applying incorrect security policies. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2024-4032) It was discovered that Python incorrectly handled quoting path names when using the venv module. A local attacker able to control virtual environments could possibly use this issue to execute arbitrary code when the virtual environment is activated. (CVE-2024-9287) It was discovered that Python incorrectly handled parsing bracketed hosts. A remote attacker could possibly use this issue to perform a Server-Side Request Forgery (SSRF) attack. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2024-11168) It was discovered that Python incorrectly handled parsing domain names that included square brackets. A remote attacker could possibly use this issue to perform a Server-Side Request Forgery (SSRF) attack. (CVE-2025-0938) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 20.04 LTS python3.8 3.8.10-0ubuntu1~20.04.16 python3.8-minimal 3.8.10-0ubuntu1~20.04.16 python3.8-venv 3.8.10-0ubuntu1~20.04.16 Ubuntu 16.04 LTS python3.5 3.5.2-2ubuntu0~16.04.13+esm16 Available with Ubuntu Pro python3.5-minimal 3.5.2-2ubuntu0~16.04.13+esm16 Available with Ubuntu Pro python3.5-venv 3.5.2-2ubuntu0~16.04.13+esm16 Available with Ubuntu Pro Ubuntu 14.04 LTS python3.5 3.5.2-2ubuntu0~16.04.4~14.04.1+esm4 Available with Ubuntu Pro python3.5-minimal 3.5.2-2ubuntu0~16.04.4~14.04.1+esm4 Available with Ubuntu Pro python3.5-venv 3.5.2-2ubuntu0~16.04.4~14.04.1+esm4 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-7348-1 CVE-2024-11168, CVE-2024-4032, CVE-2024-9287, CVE-2025-0938 Package Information: https://launchpad.net/ubuntu/+source/python3.8/3.8.10-0ub...
Attachment: OpenPGP_signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE----- wsF5BAABCAAjFiEE2WgtvmwmcgaEBLlnCAvK1QvD6SAFAmfRnSMFAwAAAAAACgkQCAvK1QvD6SCv gw//Qqzq2+TcVPgRgx/57dp4m4A8iFWQakvxLYCbgKjLxAJ0y5jWrVjDSJOgMTlQZUREdLRNWKZr 9I7zIXnwPL3pmhkHafNqe0Jm2uMZ+/UqjzbqefAxD9nz4aLCGVUm/fxkiPe0JtnwY8joXtF7sbUt tbexuFt4yWXDyr82/E492OdOO/gAJqZ0IX2zy5GRteOMxWSrhy7b2WNTqu2wKH/v4O8ULm8wRwRv p487xrO/OqeuMxUvSFwATSXkR51eU9gISfS9eJ5QHkDIzRQQY9nsw0QLPhV/t4PrW7x5xYnoVzSt Suaxc/2jqUAoJYKbCLkM+Snb0VOJILHY7Lk7cJpJxgcOSW4SLB//Q+nqOFnkvZL5Elt0Bvn8CNKB Onmud/AN9EVvmEXtvDrxzu0nvjJd//9W2BqD6917egujrB9X79QElyYZYAMJgJanHNK1M8D32Df1 WIC4O2HlPW3Z/P8/wM8IXPufMx7TdJw+dESiZq25Dr2PuJO/0fjuZzTKtdrQlH0WQoq4pZIaKwGx 7bpTz1FuNhRhwVNtC1fFYCVXbmzKDGEzD/2ZQMZtxgJytP48EVzB+EmGd/AU4vBD18284kBGqno6 GmPE0RworOPxny8+ffvnhf4YLqXI4Oi+DyRwWNVZ/9LtAwstIMRp4ozpuL3USkd66hUMvN3MP8N1 ucs= =9nrx -----END PGP SIGNATURE-----
Attachment: None (type=text/plain)