diff --git a/oval/c10f1/ALT-PU-2024-11998/definitions.json b/oval/c10f1/ALT-PU-2024-11998/definitions.json index 9caef8a5b7..d4f9d4a15e 100644 --- a/oval/c10f1/ALT-PU-2024-11998/definitions.json +++ b/oval/c10f1/ALT-PU-2024-11998/definitions.json @@ -301,6 +301,7 @@ { "ID": "CVE-2024-20996", "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", + "CWE": "NVD-CWE-noinfo", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-20996", "Impact": "Low", "Public": "20240716" @@ -308,6 +309,7 @@ { "ID": "CVE-2024-21125", "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", + "CWE": "NVD-CWE-noinfo", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-21125", "Impact": "Low", "Public": "20240716" @@ -315,6 +317,7 @@ { "ID": "CVE-2024-21127", "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", + "CWE": "NVD-CWE-noinfo", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-21127", "Impact": "Low", "Public": "20240716" @@ -322,6 +325,7 @@ { "ID": "CVE-2024-21129", "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", + "CWE": "NVD-CWE-noinfo", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-21129", "Impact": "Low", "Public": "20240716" @@ -329,6 +333,7 @@ { "ID": "CVE-2024-21130", "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", + "CWE": "NVD-CWE-noinfo", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-21130", "Impact": "Low", "Public": "20240716" @@ -336,6 +341,7 @@ { "ID": "CVE-2024-21134", "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", + "CWE": "NVD-CWE-noinfo", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-21134", "Impact": "Low", "Public": "20240716" @@ -343,6 +349,7 @@ { "ID": "CVE-2024-21135", "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", + "CWE": "NVD-CWE-noinfo", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-21135", "Impact": "Low", "Public": "20240716" @@ -350,6 +357,7 @@ { "ID": "CVE-2024-21137", "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", + "CWE": "NVD-CWE-noinfo", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-21137", "Impact": "Low", "Public": "20240716" @@ -357,6 +365,7 @@ { "ID": "CVE-2024-21142", "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", + "CWE": "NVD-CWE-noinfo", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-21142", "Impact": "Low", "Public": "20240716" @@ -364,6 +373,7 @@ { "ID": "CVE-2024-21157", "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", + "CWE": "NVD-CWE-noinfo", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-21157", "Impact": "Low", "Public": "20240716" @@ -371,6 +381,7 @@ { "ID": "CVE-2024-21159", "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", + "CWE": "NVD-CWE-noinfo", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-21159", "Impact": "Low", "Public": "20240716" @@ -378,6 +389,7 @@ { "ID": "CVE-2024-21160", "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", + "CWE": "NVD-CWE-noinfo", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-21160", "Impact": "Low", "Public": "20240716" @@ -385,6 +397,7 @@ { "ID": "CVE-2024-21162", "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", + "CWE": "NVD-CWE-noinfo", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-21162", "Impact": "Low", "Public": "20240716" @@ -392,6 +405,7 @@ { "ID": "CVE-2024-21163", "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H", + "CWE": "NVD-CWE-noinfo", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-21163", "Impact": "Low", "Public": "20240716" @@ -407,6 +421,7 @@ { "ID": "CVE-2024-21166", "CVSS3": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H", + "CWE": "NVD-CWE-noinfo", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-21166", "Impact": "Low", "Public": "20240716" @@ -422,6 +437,7 @@ { "ID": "CVE-2024-21173", "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", + "CWE": "NVD-CWE-noinfo", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-21173", "Impact": "Low", "Public": "20240716" diff --git a/oval/c9f2/ALT-PU-2024-12004/definitions.json b/oval/c9f2/ALT-PU-2024-12004/definitions.json index d7c3a795e7..2d490cda1d 100644 --- a/oval/c9f2/ALT-PU-2024-12004/definitions.json +++ b/oval/c9f2/ALT-PU-2024-12004/definitions.json @@ -301,6 +301,7 @@ { "ID": "CVE-2024-20996", "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", + "CWE": "NVD-CWE-noinfo", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-20996", "Impact": "Low", "Public": "20240716" @@ -308,6 +309,7 @@ { "ID": "CVE-2024-21125", "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", + "CWE": "NVD-CWE-noinfo", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-21125", "Impact": "Low", "Public": "20240716" @@ -315,6 +317,7 @@ { "ID": "CVE-2024-21127", "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", + "CWE": "NVD-CWE-noinfo", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-21127", "Impact": "Low", "Public": "20240716" @@ -322,6 +325,7 @@ { "ID": "CVE-2024-21129", "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", + "CWE": "NVD-CWE-noinfo", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-21129", "Impact": "Low", "Public": "20240716" @@ -329,6 +333,7 @@ { "ID": "CVE-2024-21130", "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", + "CWE": "NVD-CWE-noinfo", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-21130", "Impact": "Low", "Public": "20240716" @@ -336,6 +341,7 @@ { "ID": "CVE-2024-21134", "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", + "CWE": "NVD-CWE-noinfo", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-21134", "Impact": "Low", "Public": "20240716" @@ -343,6 +349,7 @@ { "ID": "CVE-2024-21135", "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", + "CWE": "NVD-CWE-noinfo", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-21135", "Impact": "Low", "Public": "20240716" @@ -350,6 +357,7 @@ { "ID": "CVE-2024-21137", "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", + "CWE": "NVD-CWE-noinfo", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-21137", "Impact": "Low", "Public": "20240716" @@ -357,6 +365,7 @@ { "ID": "CVE-2024-21142", "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", + "CWE": "NVD-CWE-noinfo", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-21142", "Impact": "Low", "Public": "20240716" @@ -364,6 +373,7 @@ { "ID": "CVE-2024-21157", "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", + "CWE": "NVD-CWE-noinfo", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-21157", "Impact": "Low", "Public": "20240716" @@ -371,6 +381,7 @@ { "ID": "CVE-2024-21159", "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", + "CWE": "NVD-CWE-noinfo", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-21159", "Impact": "Low", "Public": "20240716" @@ -378,6 +389,7 @@ { "ID": "CVE-2024-21160", "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", + "CWE": "NVD-CWE-noinfo", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-21160", "Impact": "Low", "Public": "20240716" @@ -385,6 +397,7 @@ { "ID": "CVE-2024-21162", "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", + "CWE": "NVD-CWE-noinfo", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-21162", "Impact": "Low", "Public": "20240716" @@ -392,6 +405,7 @@ { "ID": "CVE-2024-21163", "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H", + "CWE": "NVD-CWE-noinfo", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-21163", "Impact": "Low", "Public": "20240716" @@ -407,6 +421,7 @@ { "ID": "CVE-2024-21166", "CVSS3": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H", + "CWE": "NVD-CWE-noinfo", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-21166", "Impact": "Low", "Public": "20240716" @@ -422,6 +437,7 @@ { "ID": "CVE-2024-21173", "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", + "CWE": "NVD-CWE-noinfo", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-21173", "Impact": "Low", "Public": "20240716" diff --git a/oval/p10/ALT-PU-2024-12462/definitions.json b/oval/p10/ALT-PU-2024-12462/definitions.json index 27f17ac5f1..5205422ad0 100644 --- a/oval/p10/ALT-PU-2024-12462/definitions.json +++ b/oval/p10/ALT-PU-2024-12462/definitions.json @@ -795,6 +795,7 @@ { "ID": "CVE-2024-20996", "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", + "CWE": "NVD-CWE-noinfo", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-20996", "Impact": "Low", "Public": "20240716" @@ -961,6 +962,7 @@ { "ID": "CVE-2024-21125", "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", + "CWE": "NVD-CWE-noinfo", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-21125", "Impact": "Low", "Public": "20240716" @@ -968,6 +970,7 @@ { "ID": "CVE-2024-21127", "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", + "CWE": "NVD-CWE-noinfo", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-21127", "Impact": "Low", "Public": "20240716" @@ -975,6 +978,7 @@ { "ID": "CVE-2024-21129", "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", + "CWE": "NVD-CWE-noinfo", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-21129", "Impact": "Low", "Public": "20240716" @@ -982,6 +986,7 @@ { "ID": "CVE-2024-21130", "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", + "CWE": "NVD-CWE-noinfo", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-21130", "Impact": "Low", "Public": "20240716" @@ -989,6 +994,7 @@ { "ID": "CVE-2024-21134", "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", + "CWE": "NVD-CWE-noinfo", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-21134", "Impact": "Low", "Public": "20240716" @@ -996,6 +1002,7 @@ { "ID": "CVE-2024-21135", "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", + "CWE": "NVD-CWE-noinfo", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-21135", "Impact": "Low", "Public": "20240716" @@ -1003,6 +1010,7 @@ { "ID": "CVE-2024-21137", "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", + "CWE": "NVD-CWE-noinfo", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-21137", "Impact": "Low", "Public": "20240716" @@ -1010,6 +1018,7 @@ { "ID": "CVE-2024-21142", "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", + "CWE": "NVD-CWE-noinfo", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-21142", "Impact": "Low", "Public": "20240716" @@ -1017,6 +1026,7 @@ { "ID": "CVE-2024-21157", "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", + "CWE": "NVD-CWE-noinfo", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-21157", "Impact": "Low", "Public": "20240716" @@ -1024,6 +1034,7 @@ { "ID": "CVE-2024-21159", "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", + "CWE": "NVD-CWE-noinfo", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-21159", "Impact": "Low", "Public": "20240716" @@ -1031,6 +1042,7 @@ { "ID": "CVE-2024-21160", "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", + "CWE": "NVD-CWE-noinfo", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-21160", "Impact": "Low", "Public": "20240716" @@ -1038,6 +1050,7 @@ { "ID": "CVE-2024-21162", "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", + "CWE": "NVD-CWE-noinfo", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-21162", "Impact": "Low", "Public": "20240716" @@ -1045,6 +1058,7 @@ { "ID": "CVE-2024-21163", "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H", + "CWE": "NVD-CWE-noinfo", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-21163", "Impact": "Low", "Public": "20240716" @@ -1060,6 +1074,7 @@ { "ID": "CVE-2024-21166", "CVSS3": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H", + "CWE": "NVD-CWE-noinfo", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-21166", "Impact": "Low", "Public": "20240716" @@ -1075,6 +1090,7 @@ { "ID": "CVE-2024-21173", "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", + "CWE": "NVD-CWE-noinfo", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-21173", "Impact": "Low", "Public": "20240716" diff --git a/oval/p10/ALT-PU-2024-12993/definitions.json b/oval/p10/ALT-PU-2024-12993/definitions.json index 1d964f1514..c3efb97a4e 100644 --- a/oval/p10/ALT-PU-2024-12993/definitions.json +++ b/oval/p10/ALT-PU-2024-12993/definitions.json @@ -90,7 +90,7 @@ "Source": "CVE" } ], - "Description": "This update upgrades python3 to version 3.9.20-alt1. \nSecurity Fix(es):\n\n * BDU:2024-04927: Уязвимость модуля zipfile интерпретатора языка программирования Python (CPython), позволяющая нарушителю вызвать отказ в обслуживании\n\n * BDU:2024-05177: Уязвимость функций cert_store_stats() и get_ca_certs() модуля ssl интерпретатора языка программирования Python (CPython), позволяющая нарушителю получить несанкционированный доступ к защищаемой информации\n\n * BDU:2024-05196: Уязвимость классов ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address и ipaddress.IPv6Network модуля ipaddress интерпретатора языка программирования Python (CPython), позволяющая нарушителю получить несанкционированный доступ к защищаемой информации\n\n * BDU:2024-06863: Уязвимость модуля zipfile интерпретатора языка программирования Python, позволяющая нарушителю вызвать отказ в обслуживании\n\n * CVE-2024-0397: A defect was discovered in the Python “ssl” module where there is a memory\nrace condition with the ssl.SSLContext methods “cert_store_stats()” and\n“get_ca_certs()”. The race condition can be triggered if the methods are\ncalled at the same time as certificates are loaded into the SSLContext,\nsuch as during the TLS handshake with a certificate directory configured.\nThis issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5.\n\n * CVE-2024-0450: An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior.\n\nThe zipfile module is vulnerable to “quoted-overlap” zip-bombs which exploit the zip format to create a zip-bomb with a high compression ratio. The fixed versions of CPython makes the zipfile module reject zip archives which overlap entries in the archive.\n\n\n\n * CVE-2024-3219: There is a MEDIUM severity vulnerability affecting CPython.\n\nThe\n “socket” module provides a pure-Python fallback to the \nsocket.socketpair() function for platforms that don’t support AF_UNIX, \nsuch as Windows. This pure-Python implementation uses AF_INET or \nAF_INET6 to create a local connected pair of sockets. The connection \nbetween the two sockets was not verified before passing the two sockets \nback to the user, which leaves the server socket vulnerable to a \nconnection race from a malicious local peer.\n\nPlatforms that support AF_UNIX such as Linux and macOS are not affected by this vulnerability. Versions prior to CPython 3.5 are not affected due to the vulnerable API not being included.\n\n * CVE-2024-4032: The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the is_private and is_global properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network classes, where values wouldn’t be returned in accordance with the latest information from the IANA Special-Purpose Address Registries.\n\nCPython 3.12.4 and 3.13.0a6 contain updated information from these registries and thus have the intended behavior.\n\n * CVE-2024-5642: CPython 3.9 and earlier doesn't disallow configuring an empty list (\"[]\") for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vulnerability is of low severity due to NPN being not widely used and specifying an empty list likely being uncommon in-practice (typically a protocol name would be configured).\n\n * CVE-2024-6923: There is a MEDIUM severity vulnerability affecting CPython.\n\nThe \nemail module didn’t properly quote newlines for email headers when \nserializing an email message allowing for header injection when an email\n is serialized.\n\n * CVE-2024-7592: There is a LOW severity vulnerability affecting CPython, specifically the\n'http.cookies' standard library module.\n\n\nWhen parsing cookies that contained backslashes for quoted characters in\nthe cookie value, the parser would use an algorithm with quadratic\ncomplexity, resulting in excess CPU resources being used while parsing the\nvalue.\n\n * CVE-2024-8088: There is a HIGH severity vulnerability affecting the CPython \"zipfile\"\nmodule affecting \"zipfile.Path\". Note that the more common API \"zipfile.ZipFile\" class is unaffected.\n\n\n\n\n\nWhen iterating over names of entries in a zip archive (for example, methods\nof \"zipfile.Path\" like \"namelist()\", \"iterdir()\", etc)\nthe process can be put into an infinite loop with a maliciously crafted\nzip archive. This defect applies when reading only metadata or extracting\nthe contents of the zip archive. Programs that are not handling\nuser-controlled zip archives are not affected.", + "Description": "This update upgrades python3 to version 3.9.20-alt1. \nSecurity Fix(es):\n\n * BDU:2024-04927: Уязвимость модуля zipfile интерпретатора языка программирования Python (CPython), позволяющая нарушителю вызвать отказ в обслуживании\n\n * BDU:2024-05177: Уязвимость функций cert_store_stats() и get_ca_certs() модуля ssl интерпретатора языка программирования Python (CPython), позволяющая нарушителю получить несанкционированный доступ к защищаемой информации\n\n * BDU:2024-05196: Уязвимость классов ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address и ipaddress.IPv6Network модуля ipaddress интерпретатора языка программирования Python (CPython), позволяющая нарушителю получить несанкционированный доступ к защищаемой информации\n\n * BDU:2024-06863: Уязвимость модуля zipfile интерпретатора языка программирования Python, позволяющая нарушителю вызвать отказ в обслуживании\n\n * CVE-2024-0397: A defect was discovered in the Python “ssl” module where there is a memory\nrace condition with the ssl.SSLContext methods “cert_store_stats()” and\n“get_ca_certs()”. The race condition can be triggered if the methods are\ncalled at the same time as certificates are loaded into the SSLContext,\nsuch as during the TLS handshake with a certificate directory configured.\nThis issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5.\n\n * CVE-2024-0450: An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior.\n\nThe zipfile module is vulnerable to “quoted-overlap” zip-bombs which exploit the zip format to create a zip-bomb with a high compression ratio. The fixed versions of CPython makes the zipfile module reject zip archives which overlap entries in the archive.\n\n\n\n * CVE-2024-3219: The\n “socket” module provides a pure-Python fallback to the \nsocket.socketpair() function for platforms that don’t support AF_UNIX, \nsuch as Windows. This pure-Python implementation uses AF_INET or \nAF_INET6 to create a local connected pair of sockets. The connection \nbetween the two sockets was not verified before passing the two sockets \nback to the user, which leaves the server socket vulnerable to a \nconnection race from a malicious local peer.\n\nPlatforms that support AF_UNIX such as Linux and macOS are not affected by this vulnerability. Versions prior to CPython 3.5 are not affected due to the vulnerable API not being included.\n\n * CVE-2024-4032: The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the is_private and is_global properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network classes, where values wouldn’t be returned in accordance with the latest information from the IANA Special-Purpose Address Registries.\n\nCPython 3.12.4 and 3.13.0a6 contain updated information from these registries and thus have the intended behavior.\n\n * CVE-2024-5642: CPython 3.9 and earlier doesn't disallow configuring an empty list (\"[]\") for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vulnerability is of low severity due to NPN being not widely used and specifying an empty list likely being uncommon in-practice (typically a protocol name would be configured).\n\n * CVE-2024-6923: There is a MEDIUM severity vulnerability affecting CPython.\n\nThe \nemail module didn’t properly quote newlines for email headers when \nserializing an email message allowing for header injection when an email\n is serialized.\n\n * CVE-2024-7592: There is a LOW severity vulnerability affecting CPython, specifically the\n'http.cookies' standard library module.\n\n\nWhen parsing cookies that contained backslashes for quoted characters in\nthe cookie value, the parser would use an algorithm with quadratic\ncomplexity, resulting in excess CPU resources being used while parsing the\nvalue.\n\n * CVE-2024-8088: There is a HIGH severity vulnerability affecting the CPython \"zipfile\"\nmodule affecting \"zipfile.Path\". Note that the more common API \"zipfile.ZipFile\" class is unaffected.\n\n\n\n\n\nWhen iterating over names of entries in a zip archive (for example, methods\nof \"zipfile.Path\" like \"namelist()\", \"iterdir()\", etc)\nthe process can be put into an infinite loop with a maliciously crafted\nzip archive. This defect applies when reading only metadata or extracting\nthe contents of the zip archive. Programs that are not handling\nuser-controlled zip archives are not affected.", "Advisory": { "From": "errata.altlinux.org", "Severity": "High",