Anolis OS update for python3



| Updated: 2025-03-28
Risk High
Patch available YES
Number of vulnerabilities 6
CVE-ID CVE-2023-27043
CVE-2007-4559
CVE-2001-1267
CVE-2022-48560
CVE-2022-48564
CVE-2023-40217
CWE-ID CWE-20
CWE-22
CWE-416
CWE-400
CWE-319
Exploitation vector Network
Public exploit Public exploit code for vulnerability #2 is available.
Vulnerable software
 Anolis OS
Operating systems & Components / Operating system

python3-tkinter
Operating systems & Components / Operating system package or component

python3-test
Operating systems & Components / Operating system package or component

python3-libs
Operating systems & Components / Operating system package or component

python3-idle
Operating systems & Components / Operating system package or component

python3-devel
Operating systems & Components / Operating system package or component

platform-python-devel
Operating systems & Components / Operating system package or component

platform-python-debug
Operating systems & Components / Operating system package or component

platform-python
Operating systems & Components / Operating system package or component

Vendor OpenAnolis

Security Bulletin

This security bulletin contains information about 6 vulnerabilities.

1) Input validation error

EUVDB-ID: #VU82980

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-27043

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass filtration.

The vulnerability exists due to insufficient validation of user-supplied input when parsing email address with a special character. A remote attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Anolis OS: 8

python3-tkinter: before 3.6.8-56.0.1

python3-test: before 3.6.8-56.0.1

python3-libs: before 3.6.8-56.0.1

python3-idle: before 3.6.8-56.0.1

python3-devel: before 3.6.8-56.0.1

platform-python-devel: before 3.6.8-56.0.1

platform-python-debug: before 3.6.8-56.0.1

platform-python: before 3.6.8-56.0.1

CPE2.3 External links

https://anas.openanolis.cn/errata/detail/ANSA-2024:0082


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Path traversal

EUVDB-ID: #VU67583

Risk: High

CVSSv4.0: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2007-4559

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to improper validation of filenames in the tarfile module in Python. A remote attacker can create a specially crafted archive with symbolic links inside or filenames that contain directory traversal characters (e.g. "..") and overwrite arbitrary files on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Anolis OS: 8

python3-tkinter: before 3.6.8-56.0.1

python3-test: before 3.6.8-56.0.1

python3-libs: before 3.6.8-56.0.1

python3-idle: before 3.6.8-56.0.1

python3-devel: before 3.6.8-56.0.1

platform-python-devel: before 3.6.8-56.0.1

platform-python-debug: before 3.6.8-56.0.1

platform-python: before 3.6.8-56.0.1

CPE2.3 External links

https://anas.openanolis.cn/errata/detail/ANSA-2024:0082


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

3) Path traversal

EUVDB-ID: #VU93014

Risk: High

CVSSv4.0: 6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2001-1267

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences. A remote attacker can trick the victim to open a specially crafted archive and overwrite arbitrary files on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Anolis OS: 8

python3-tkinter: before 3.6.8-56.0.1

python3-test: before 3.6.8-56.0.1

python3-libs: before 3.6.8-56.0.1

python3-idle: before 3.6.8-56.0.1

python3-devel: before 3.6.8-56.0.1

platform-python-devel: before 3.6.8-56.0.1

platform-python-debug: before 3.6.8-56.0.1

platform-python: before 3.6.8-56.0.1

CPE2.3 External links

https://anas.openanolis.cn/errata/detail/ANSA-2024:0082


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Use-after-free

EUVDB-ID: #VU82078

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-48560

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to use-after-free exists via heappushpop in heapq. A remote attacker can trigger the vulnerability to perform a denial of service attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Anolis OS: 8

python3-tkinter: before 3.6.8-56.0.1

python3-test: before 3.6.8-56.0.1

python3-libs: before 3.6.8-56.0.1

python3-idle: before 3.6.8-56.0.1

python3-devel: before 3.6.8-56.0.1

platform-python-devel: before 3.6.8-56.0.1

platform-python-debug: before 3.6.8-56.0.1

platform-python: before 3.6.8-56.0.1

CPE2.3 External links

https://anas.openanolis.cn/errata/detail/ANSA-2024:0082


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Resource exhaustion

EUVDB-ID: #VU82077

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-48564

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability occurs when processing malformed Apple Property List files in binary format. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Anolis OS: 8

python3-tkinter: before 3.6.8-56.0.1

python3-test: before 3.6.8-56.0.1

python3-libs: before 3.6.8-56.0.1

python3-idle: before 3.6.8-56.0.1

python3-devel: before 3.6.8-56.0.1

platform-python-devel: before 3.6.8-56.0.1

platform-python-debug: before 3.6.8-56.0.1

platform-python: before 3.6.8-56.0.1

CPE2.3 External links

https://anas.openanolis.cn/errata/detail/ANSA-2024:0082


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Cleartext transmission of sensitive information

EUVDB-ID: #VU80228

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-40217

CWE-ID: CWE-319 - Cleartext Transmission of Sensitive Information

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to an error in ssl.SSLSocket implementation when handling TLS client authentication. A remote attacker can trick the application to send data unencrypted.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Anolis OS: 8

python3-tkinter: before 3.6.8-56.0.1

python3-test: before 3.6.8-56.0.1

python3-libs: before 3.6.8-56.0.1

python3-idle: before 3.6.8-56.0.1

python3-devel: before 3.6.8-56.0.1

platform-python-devel: before 3.6.8-56.0.1

platform-python-debug: before 3.6.8-56.0.1

platform-python: before 3.6.8-56.0.1

CPE2.3 External links

https://anas.openanolis.cn/errata/detail/ANSA-2024:0082


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###