python312-3.12.5-1.1 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:14295-1 Final 1 1 2024-08-29T00:00:00Z current 2024-08-29T00:00:00Z 2024-08-29T00:00:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z python312-3.12.5-1.1 on GA media These are all security issues fixed in the python312-3.12.5-1.1 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-14295 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2024-0397/ SUSE CVE CVE-2024-0397 page https://www.suse.com/security/cve/CVE-2024-4030/ SUSE CVE CVE-2024-4030 page https://www.suse.com/security/cve/CVE-2024-4032/ SUSE CVE CVE-2024-4032 page https://www.suse.com/security/cve/CVE-2024-6923/ SUSE CVE CVE-2024-6923 page openSUSE Tumbleweed python312-3.12.5-1.1 python312-32bit-3.12.5-1.1 python312-curses-3.12.5-1.1 python312-dbm-3.12.5-1.1 python312-idle-3.12.5-1.1 python312-tk-3.12.5-1.1 python312-x86-64-v3-3.12.5-1.1 python312-3.12.5-1.1 as a component of openSUSE Tumbleweed python312-32bit-3.12.5-1.1 as a component of openSUSE Tumbleweed python312-curses-3.12.5-1.1 as a component of openSUSE Tumbleweed python312-dbm-3.12.5-1.1 as a component of openSUSE Tumbleweed python312-idle-3.12.5-1.1 as a component of openSUSE Tumbleweed python312-tk-3.12.5-1.1 as a component of openSUSE Tumbleweed python312-x86-64-v3-3.12.5-1.1 as a component of openSUSE Tumbleweed A defect was discovered in the Python "ssl" module where there is a memory race condition with the ssl.SSLContext methods "cert_store_stats()" and "get_ca_certs()". The race condition can be triggered if the methods are called at the same time as certificates are loaded into the SSLContext, such as during the TLS handshake with a certificate directory configured. This issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5. CVE-2024-0397 openSUSE Tumbleweed:python312-3.12.5-1.1 openSUSE Tumbleweed:python312-32bit-3.12.5-1.1 openSUSE Tumbleweed:python312-curses-3.12.5-1.1 openSUSE Tumbleweed:python312-dbm-3.12.5-1.1 openSUSE Tumbleweed:python312-idle-3.12.5-1.1 openSUSE Tumbleweed:python312-tk-3.12.5-1.1 openSUSE Tumbleweed:python312-x86-64-v3-3.12.5-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2024-0397.html CVE-2024-0397 https://bugzilla.suse.com/1226447 SUSE Bug 1226447 On Windows a directory returned by tempfile.mkdtemp() would not always have permissions set to restrict reading and writing to the temporary directory by other users, instead usually inheriting the correct permissions from the default location. Alternate configurations or users without a profile directory may not have the intended permissions. If you're not using Windows or haven't changed the temporary directory location then you aren't affected by this vulnerability. On other platforms the returned directory is consistently readable and writable only by the current user. This issue was caused by Python not supporting Unix permissions on Windows. The fix adds support for Unix "700" for the mkdir function on Windows which is used by mkdtemp() to ensure the newly created directory has the proper permissions. CVE-2024-4030 openSUSE Tumbleweed:python312-3.12.5-1.1 openSUSE Tumbleweed:python312-32bit-3.12.5-1.1 openSUSE Tumbleweed:python312-curses-3.12.5-1.1 openSUSE Tumbleweed:python312-dbm-3.12.5-1.1 openSUSE Tumbleweed:python312-idle-3.12.5-1.1 openSUSE Tumbleweed:python312-tk-3.12.5-1.1 openSUSE Tumbleweed:python312-x86-64-v3-3.12.5-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2024-4030.html CVE-2024-4030 https://bugzilla.suse.com/1227152 SUSE Bug 1227152 The "ipaddress" module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as "globally reachable" or "private". This affected the is_private and is_global properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network classes, where values wouldn't be returned in accordance with the latest information from the IANA Special-Purpose Address Registries. CPython 3.12.4 and 3.13.0a6 contain updated information from these registries and thus have the intended behavior. CVE-2024-4032 openSUSE Tumbleweed:python312-3.12.5-1.1 openSUSE Tumbleweed:python312-32bit-3.12.5-1.1 openSUSE Tumbleweed:python312-curses-3.12.5-1.1 openSUSE Tumbleweed:python312-dbm-3.12.5-1.1 openSUSE Tumbleweed:python312-idle-3.12.5-1.1 openSUSE Tumbleweed:python312-tk-3.12.5-1.1 openSUSE Tumbleweed:python312-x86-64-v3-3.12.5-1.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2024-4032.html CVE-2024-4032 https://bugzilla.suse.com/1226448 SUSE Bug 1226448 There is a MEDIUM severity vulnerability affecting CPython. The email module didn't properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized. CVE-2024-6923 openSUSE Tumbleweed:python312-3.12.5-1.1 openSUSE Tumbleweed:python312-32bit-3.12.5-1.1 openSUSE Tumbleweed:python312-curses-3.12.5-1.1 openSUSE Tumbleweed:python312-dbm-3.12.5-1.1 openSUSE Tumbleweed:python312-idle-3.12.5-1.1 openSUSE Tumbleweed:python312-tk-3.12.5-1.1 openSUSE Tumbleweed:python312-x86-64-v3-3.12.5-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2024-6923.html CVE-2024-6923 https://bugzilla.suse.com/1228780 SUSE Bug 1228780