MGASA-2021-0386
- Source
- https://advisories.mageia.org/MGASA-2021-0386.html
- Import Source
- https://advisories.mageia.org/MGASA-2021-0386.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/MGASA-2021-0386
- Related
- Published
- 2021-07-27T20:21:53Z
- Modified
- 2021-07-27T19:59:45Z
- Summary
- Updated python3 packages fix security vulnerabilities
- Details
-
Update python3 to 3.8.11 to fix several security issues. Fixes in 3.8.10 are also included.
Bundled pip and setuptools were updated in 3.8.11 so python-pip needs to be updated to 21.1.3 and python-setuptools to 56.2.0 at the same time.
Also, we fix the following issue:
In Python before 3.9.5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses (CVE-2021-29921).
- References
-
- https://advisories.mageia.org/MGASA-2021-0386.html
- https://bugs.mageia.org/show_bug.cgi?id=29288
- https://docs.python.org/release/3.8.11/whatsnew/changelog.html#changelog
- https://docs.python.org/release/3.8.10/whatsnew/changelog.html#changelog
- https://ubuntu.com/security/notices/USN-4973-1
- https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html
- Credits
-
-
- Mageia - COORDINATOR
-
Affected packages
Mageia:8 / python-pip
Package
- Name
- python-pip
- Purl
- pkg:rpm/mageia/python-pip?distro=mageia-8
Mageia:8 / python-setuptools
Package
- Name
- python-setuptools
- Purl
- pkg:rpm/mageia/python-setuptools?distro=mageia-8
Mageia:8 / python3
Package
- Name
- python3
- Purl
- pkg:rpm/mageia/python3?distro=mageia-8