Security update for python310

2024-09-2015:13:09

Google

osv.dev

python 310

security update

denial of service

cpu resource consumption

vulnerabilities

http cookies

zipfile

version 3.10.15

redos

header values.

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS4

8.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/SC:N/VI:N/SI:N/VA:H/SA:N/S:N/AU:N/R:U/RE:L

AI Score

7.2

Confidence

High

JSON

This update for python310 fixes the following issues:

Update to version 3.10.15
CVE-2024-8088: Fixed denial of service in zipfile. (bsc#1229704)
CVE-2024-7592: Fixed uncontrolled CPU resource consumption when in http.cookies module. (bsc#1229596)
CVE-2024-6232: Fixed ReDos via excessive backtracking while parsing header values. (bsc#1230227)