Most recent entries from all

ALSA-2024:3466 — Important: python39:3.9 and python39-devel:3.9 security update

Affected: AlmaLinux:8: python39, AlmaLinux:8: python39-Cython, AlmaLinux:8: python39-PyMySQL, AlmaLinux:8: python39-attrs, AlmaLinux:8: python39-cffi, AlmaLinux:8: python39-chardet, AlmaLinux:8: python39-cryptography, AlmaLinux:8: python39-debug, AlmaLinux:8: python39-devel, AlmaLinux:8: python39-idle and 39 more

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* python39:3.9/python39: python: Path traversal on tempfile.TemporaryDirectory (CVE-2023-6597) * python39:3.9/python39: python: The zipfile module is vulnerable to zip-bombs leading to denial of service (CVE-2024-0450) * python39:3.9/python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode() (CVE-2024-3651)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2024-04211

BELL-CVE-2024-3651

Affected: Alpaquita:23: py3-idna, Alpaquita:stream: py3-idna

BREW-abi3audit-CVE-2024-3651 — Internationalized Domain Names in Applications (IDNA) vulnerable to denial of service from specially crafted inputs to…

Affected: Homebrew: abi3audit

### Impact A specially crafted argument to the `idna.encode()` function could consume significant resources. This may lead to a denial-of-service.

### Patches The function has been refined to reject such strings without the associated resource consumption in version 3.7.

### Workarounds Domain names cannot exceed 253 characters in length, if this length limit is enforced prior to passing the domain to the `idna.encode()` function it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application.

### References * https://huntr.com/bounties/93d78d07-d791-4b39-a845-cbfabc44aadb

certfr-2024-avi-0535 — De multiples vulnérabilités ont été découvertes dans les produits Splunk. Certaines d'entre elles permettent à un attaq…

certfr-2024-avi-0535

EUVD-2026-260141

fkie_cve-2024-3651

A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service condition. This vulnerability is triggered by a crafted input that causes the `idna.encode()` function to process the input with considerable computational load, significantly increasing the processing time in a quadratic manner relative to the input size.

GHSA-jjg7-2v4v-x38h — Internationalized Domain Names in Applications (IDNA) vulnerable to denial of service from specially crafted inputs to…

Affected: PyPI: idna

### Impact A specially crafted argument to the `idna.encode()` function could consume significant resources. This may lead to a denial-of-service.

### Patches The function has been refined to reject such strings without the associated resource consumption in version 3.7.

### References * https://huntr.com/bounties/93d78d07-d791-4b39-a845-cbfabc44aadb

gsd-2024-3651

msrc_CVE-2024-3651 — Denial of Service via Quadratic Complexity in kjd/idna

msrc_CVE-2024-3651

OESA-2024-1606 — python-idna security update

Affected: openEuler:20.03-LTS-SP1: python-idna, openEuler:22.03-LTS: python-idna, openEuler:22.03-LTS-SP1: python-idna

A library to support the Internationalised Domain Names in Applications (IDNA) protocol as specified in RFC 5891 http://tools.ietf.org/html/rfc5891. This version of the protocol is often referred to as “IDNA2008” and can produce different results from the earlier standard from 2003. Security Fix(es): A flaw was found in the python-idna library. A malicious argument was sent to the idna.encode() function can trigger an uncontrolled resource consumption, resulting in a denial of service.(CVE-2024-3651)

openSUSE-SU-2024:13874-1 — python310-idna-3.7-1.1 on GA media

python310-idna-3.7-1.1 on GA media

PYSEC-2024-60

Affected: PyPI: idna

RHSA-2024:3466 — Red Hat Security Advisory: python39:3.9 and python39-devel:3.9 security update

python: Path traversal on tempfile.TemporaryDirectory python: The zipfile module is vulnerable to zip-bombs leading to denial of service python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode()

SUSE-EL-9-CLIENT-TOOLS-2024-4029 — Security update for SUSE Manager Salt Bundle

Security update for SUSE Manager Salt Bundle

UBUNTU-CVE-2024-3651

Affected: Ubuntu:Pro:16.04:LTS: python-idna, Ubuntu:Pro:16.04:LTS: python-pip, Ubuntu:Pro:18.04:LTS: python-idna, Ubuntu:Pro:18.04:LTS: python-pip, Ubuntu:20.04:LTS: python-idna, Ubuntu:Pro:20.04:LTS: python-pip, Ubuntu:22.04:LTS: python-idna, Ubuntu:22.04:LTS: python-pip, Ubuntu:24.04:LTS: python-idna, Ubuntu:24.04:LTS: python-pip

WID-SEC-W-2024-1269 — Red Hat Enterprise Linux (python-idna): Schwachstelle ermöglicht Denial of Service

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuführen.