SUSE update for python3

Published: 2024-09-18

Risk	Medium
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2024-6923 CVE-2024-7592
CWE-ID	CWE-77 CWE-400
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	SUSE Linux Enterprise Server for SAP Applications 15 Operating systems & Components / Operating system SUSE Linux Enterprise Server 15 SP2 LTSS Operating systems & Components / Operating system SUSE Linux Enterprise Server 15 Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing 15 Operating systems & Components / Operating system SUSE Linux Enterprise Micro Operating systems & Components / Operating system python3-tk Operating systems & Components / Operating system package or component python3 Operating systems & Components / Operating system package or component python3-debuginfo Operating systems & Components / Operating system package or component python3-dbm-debuginfo Operating systems & Components / Operating system package or component python3-tk-debuginfo Operating systems & Components / Operating system package or component python3-curses Operating systems & Components / Operating system package or component python3-idle Operating systems & Components / Operating system package or component libpython3_6m1_0-debuginfo Operating systems & Components / Operating system package or component python3-core-debugsource Operating systems & Components / Operating system package or component python3-devel Operating systems & Components / Operating system package or component python3-curses-debuginfo Operating systems & Components / Operating system package or component python3-devel-debuginfo Operating systems & Components / Operating system package or component python3-debugsource Operating systems & Components / Operating system package or component python3-dbm Operating systems & Components / Operating system package or component python3-base Operating systems & Components / Operating system package or component libpython3_6m1_0 Operating systems & Components / Operating system package or component python3-base-debuginfo Operating systems & Components / Operating system package or component python3-tools Operating systems & Components / Operating system package or component
Vendor	SUSE

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Command Injection

EUVDB-ID: #VU95571

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-6923

CWE-ID: CWE-77 - Command injection

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to insufficient validation of newlines for email headers when serializing an email message. A remote attacker can inject arbitrary headers into serialized email messages.

Mitigation

Update the affected package python3 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP Applications 15: SP2

SUSE Linux Enterprise Server 15 SP2 LTSS: 15-SP2

SUSE Linux Enterprise Server 15: SP2

SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS: 15-SP2

SUSE Linux Enterprise High Performance Computing 15: SP2

SUSE Linux Enterprise Micro: 5.1

python3-tk: before 3.6.15-150000.3.155.2

python3: before 3.6.15-150000.3.155.2

python3-debuginfo: before 3.6.15-150000.3.155.2

python3-dbm-debuginfo: before 3.6.15-150000.3.155.2

python3-tk-debuginfo: before 3.6.15-150000.3.155.2

python3-curses: before 3.6.15-150000.3.155.2

python3-idle: before 3.6.15-150000.3.155.2

libpython3_6m1_0-debuginfo: before 3.6.15-150000.3.155.2

python3-core-debugsource: before 3.6.15-150000.3.155.2

python3-devel: before 3.6.15-150000.3.155.2

python3-curses-debuginfo: before 3.6.15-150000.3.155.2

python3-devel-debuginfo: before 3.6.15-150000.3.155.2

python3-debugsource: before 3.6.15-150000.3.155.2

python3-dbm: before 3.6.15-150000.3.155.2

python3-base: before 3.6.15-150000.3.155.2

libpython3_6m1_0: before 3.6.15-150000.3.155.2

python3-base-debuginfo: before 3.6.15-150000.3.155.2

python3-tools: before 3.6.15-150000.3.155.2

External links

http://www.suse.com/support/update/announcement/2024/suse-su-20243302-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Resource exhaustion

EUVDB-ID: #VU96945