Lucene search

K
slackwareSlackware Linux ProjectSSA-2022-250-01
HistorySep 07, 2022 - 6:45 p.m.

[slackware-security] python3

2022-09-0718:45:50
Slackware Linux Project
www.slackware.com
27
slackware
python3
security issue
upgrade
patch
cve-2020-10735
algorithmic complexity
denial of service
ftp
rsync
hosting

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.006

Percentile

77.9%

New python3 packages are available for Slackware 15.0 and -current to fix
a security issue.

Here are the details from the Slackware 15.0 ChangeLog:

patches/packages/python3-3.9.14-i586-1_slack15.0.txz: Upgraded.
This is a security and bugfix release.
gh-95778: Converting between int and str in bases other than 2 (binary), 4,
8 (octal), 16 (hexadecimal), or 32 such as base 10 (decimal) now raises a
ValueError if the number of digits in string form is above a limit to avoid
potential denial of service attacks due to the algorithmic complexity.
For more information, see:
https://pythoninsider.blogspot.com/2022/09/python-releases-3107-3914-3814-and-3714.html
https://vulners.com/cve/CVE-2020-10735
(* Security fix *)

Where to find the new packages:

Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project! :-)

Also see the “Get Slack” section on http://slackware.com for
additional mirror sites near you.

Updated package for Slackware 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware-15.0/patches/packages/python3-3.9.14-i586-1_slack15.0.txz

Updated package for Slackware x86_64 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-15.0/patches/packages/python3-3.9.14-x86_64-1_slack15.0.txz

Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/d/python3-3.9.14-i586-1.txz

Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/d/python3-3.9.14-x86_64-1.txz

MD5 signatures:

Slackware 15.0 package:
7d7081d3330dc5689f3fe5e82ae29d1e python3-3.9.14-i586-1_slack15.0.txz

Slackware x86_64 15.0 package:
829a5fb5ab12594a6864d5211aeda6d9 python3-3.9.14-x86_64-1_slack15.0.txz

Slackware -current package:
5a0be4fea2015a3ec28606bd68249825 d/python3-3.9.14-i586-1.txz

Slackware x86_64 -current package:
88568701eb29700fe01833eec6a1e997 d/python3-3.9.14-x86_64-1.txz

Installation instructions:

Upgrade the package as root:
> upgradepkg python3-3.9.14-i586-1_slack15.0.txz

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.006

Percentile

77.9%