Debian alert DLA-4354-1 (pypy3)
| From: | Andrej Shadura <andrewsh@debian.org> | |
| To: | debian-lts-announce@lists.debian.org | |
| Subject: | [SECURITY] [DLA 4354-1] pypy3 security update | |
| Date: | Fri, 31 Oct 2025 10:08:16 +0100 | |
| Message-ID: | <20251031090819.2164259-1-andrewsh@debian.org> |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4354-1 debian-lts@lists.debian.org https://www.debian.org/lts/security/ Andrej Shadura October 31, 2025 https://wiki.debian.org/LTS - ------------------------------------------------------------------------- Package : pypy3 Version : 7.3.5+dfsg-2+deb11u5 CVE ID : CVE-2024-6232 CVE-2024-6923 CVE-2024-7592 CVE-2024-11168 CVE-2025-0938 CVE-2025-1795 CVE-2025-6069 CVE-2025-8291 This upload fixes a few of security issues in the Python standard library included with PyPy, an alternative implementation of the Python 3 language. CVE-2024-6232 The tarfile module used to parse tar parsed header values with regular expressions that allowed for backtracking, which could be used to cause denial of service via specifically-crafted tar archives (ReDoS). Since tar headers have a well-known format that doesn't require backtracking to parse reliably, the new method of parsing only requires a single pass over a byte stream. CVE-2024-6923 The email module didn’t properly quote newlines when serialising email messages, which could be used to inject newlines that would affect the interpretation of the email headers. An attacker could cause some email headers to be completely skipped or potentially hide malicious headers within other headers. CVE-2024-7592 The http.cookies, when parsing cookies that contained backslashes for quoted characters in the cookie value, would use an algorithm with quadratic complexity, resulting in excess CPU resources being used while parsing the value. E.g. parsing a 20000+ byte cookie would take about a second (ReDoS). CVE-2024-11168 and CVE-2025-0938 The urllib.parse.urlsplit and urlparse functions improperly validated domain names that included square brackets allowing hosts that weren't IPv6 or IPvFuture. CVE-2025-1795 In the email module, during an address list folding, when a separating comma ended up on a folded line and that line is to be Unicode-encoded, then the separator itself was also Unicode-encoded. Expected behavior is that the separating comma remains a plan comma. This could result in the address header being misinterpreted by some mail servers. CVE-2025-6069 The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service. CVE-2025-8291 The zipfile module would not check the validity of the ZIP64 End of Central Directory (EOCD). Locator record offset value would not be used to locate the ZIP64 EOCD record, but instead the ZIP64 EOCD record would be assumed to be the previous record in the ZIP archive. This could be abused to create ZIP archives that are handled differently by the zipfile module compared to other ZIP implementations. Remediation maintains this behavior, but checks that the offset specified in the ZIP64 EOCD Locator record matches the expected value. For Debian 11 bullseye, these problems have been fixed in version 7.3.5+dfsg-2+deb11u5. We recommend that you upgrade your pypy3 packages. For the detailed security status of pypy3 please refer to its security tracker page at: https://security-tracker.debian.org/tracker/pypy3 Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS -----BEGIN PGP SIGNATURE----- iHUEARYKAB0WIQSD3NF/RLIsyDZW7aHoRGtKyMdyYQUCaQRmVQAKCRDoRGtKyMdy YZ7uAQDJYcRn/ljnSQKukfrLjO+31NX7JmEZFRFxTZvGUNS3GQD/YXiuzm6L9Kyo CyM7Xmju6UCl4JjmRMdWa7ateNnt9wE= =2vjt -----END PGP SIGNATURE-----