ALASPYTHON3.8-2023-001

Related Vulnerabilities: CVE-2023-24329  

An issue in the urllib.parse component of Python before v3.11 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters. (CVE-2023-24329)

ALASPYTHON3.8-2023-001


Amazon Linux 2 Security Advisory: ALASPYTHON3.8-2023-001
Advisory Release Date: 2023-08-04 20:34 Pacific
Advisory Updated Date: 2023-09-25 22:05 Pacific
Severity: Medium

Issue Overview:

An issue in the urllib.parse component of Python before v3.11 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters. (CVE-2023-24329)


Affected Packages:

python38


Issue Correction:
Run yum update python38 to update your system.

New Packages:
aarch64:
    python38-3.8.16-1.amzn2.0.2.aarch64
    python38-libs-3.8.16-1.amzn2.0.2.aarch64
    python38-devel-3.8.16-1.amzn2.0.2.aarch64
    python38-tools-3.8.16-1.amzn2.0.2.aarch64
    python38-tkinter-3.8.16-1.amzn2.0.2.aarch64
    python38-test-3.8.16-1.amzn2.0.2.aarch64
    python38-debug-3.8.16-1.amzn2.0.2.aarch64
    python38-debuginfo-3.8.16-1.amzn2.0.2.aarch64

src:
    python38-3.8.16-1.amzn2.0.2.src

x86_64:
    python38-3.8.16-1.amzn2.0.2.x86_64
    python38-libs-3.8.16-1.amzn2.0.2.x86_64
    python38-devel-3.8.16-1.amzn2.0.2.x86_64
    python38-tools-3.8.16-1.amzn2.0.2.x86_64
    python38-tkinter-3.8.16-1.amzn2.0.2.x86_64
    python38-test-3.8.16-1.amzn2.0.2.x86_64
    python38-debug-3.8.16-1.amzn2.0.2.x86_64
    python38-debuginfo-3.8.16-1.amzn2.0.2.x86_64