RHSA-2024:2987MediumCVSS 7.5

Red Hat Security Advisory: python27:2.7 security update

Published
May 22, 2024
Last Modified
October 14, 2026

🔗 CVE IDs covered (5)

CVE-2022-40897 →CVE-2022-48560 →CVE-2022-48565 →CVE-2023-43804 →CVE-2024-22195 →

📋 Description

CVE-2022-40897 — pypa-setuptools: Regular Expression Denial of Service (ReDoS) in package_index.py CVE-2022-48560 — python: use after free in heappushpop() of heapq module CVE-2022-48565 — python: XML External Entity in XML processing plistlib module CVE-2023-43804 — python-urllib3: Cookie request header isn't stripped during cross-origin redirects CVE-2024-22195 — jinja2: HTML attribute injection when passing user input as keys to xmlattr filter

🎯 Affected products200

  • Red Hat Enterprise Linux AppStream (v. 8)
  • Cython-0:0.28.1-7.module+el8.9.0+19487+7dc18407.src (python27:2.7) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • Cython-debugsource-0:0.28.1-7.module+el8.9.0+19487+7dc18407.aarch64 (python27:2.7) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • Cython-debugsource-0:0.28.1-7.module+el8.9.0+19487+7dc18407.ppc64le (python27:2.7) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • Cython-debugsource-0:0.28.1-7.module+el8.9.0+19487+7dc18407.s390x (python27:2.7) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • Cython-debugsource-0:0.28.1-7.module+el8.9.0+19487+7dc18407.x86_64 (python27:2.7) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • PyYAML-0:3.12-16.module+el8.9.0+19487+7dc18407.src (python27:2.7) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • PyYAML-debugsource-0:3.12-16.module+el8.9.0+19487+7dc18407.aarch64 (python27:2.7) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • PyYAML-debugsource-0:3.12-16.module+el8.9.0+19487+7dc18407.ppc64le (python27:2.7) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • PyYAML-debugsource-0:3.12-16.module+el8.9.0+19487+7dc18407.s390x (python27:2.7) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • PyYAML-debugsource-0:3.12-16.module+el8.9.0+19487+7dc18407.x86_64 (python27:2.7) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • babel-0:2.5.1-10.module+el8.9.0+19487+7dc18407.noarch (python27:2.7) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • babel-0:2.5.1-10.module+el8.9.0+19487+7dc18407.src (python27:2.7) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • numpy-1:1.14.2-16.module+el8.9.0+19487+7dc18407.src (python27:2.7) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • numpy-debugsource-1:1.14.2-16.module+el8.9.0+19487+7dc18407.aarch64 (python27:2.7) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • numpy-debugsource-1:1.14.2-16.module+el8.9.0+19487+7dc18407.ppc64le (python27:2.7) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • numpy-debugsource-1:1.14.2-16.module+el8.9.0+19487+7dc18407.s390x (python27:2.7) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • numpy-debugsource-1:1.14.2-16.module+el8.9.0+19487+7dc18407.x86_64 (python27:2.7) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • pytest-0:3.4.2-13.module+el8.9.0+19487+7dc18407.src (python27:2.7) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • python-PyMySQL-0:0.8.0-10.module+el8.9.0+19487+7dc18407.src (python27:2.7) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • python-attrs-0:17.4.0-10.module+el8.9.0+19487+7dc18407.src (python27:2.7) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • python-backports-0:1.0-16.module+el8.9.0+18326+1b5baeee.src (python27:2.7) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • python-backports-ssl_match_hostname-0:3.5.0.1-12.module+el8.9.0+18326+1b5baeee.src (python27:2.7) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • python-chardet-0:3.0.4-10.module+el8.9.0+19487+7dc18407.src (python27:2.7) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • python-coverage-0:4.5.1-5.module+el8.9.0+19487+7dc18407.src (python27:2.7) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • python-coverage-debugsource-0:4.5.1-5.module+el8.9.0+19487+7dc18407.aarch64 (python27:2.7) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • python-coverage-debugsource-0:4.5.1-5.module+el8.9.0+19487+7dc18407.ppc64le (python27:2.7) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • python-coverage-debugsource-0:4.5.1-5.module+el8.9.0+19487+7dc18407.s390x (python27:2.7) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • python-coverage-debugsource-0:4.5.1-5.module+el8.9.0+19487+7dc18407.x86_64 (python27:2.7) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • python-dns-0:1.15.0-10.module+el8.9.0+19487+7dc18407.src (python27:2.7) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • +170 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: The XML modules in python are not secure against erroneous or maliciously constructed data. If you need to parse untrusted or unauthenticated data, see the XML vulnerabilities and the defusedxml package sections. https://docs.python.org/dev/library/xml.html Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (9)