USN-6139-1: Python vulnerability

Packages

python2.7 - An interactive high-level object-oriented language
python3.10 - An interactive high-level object-oriented language
python3.11 - An interactive high-level object-oriented language
python3.5 - An interactive high-level object-oriented language
python3.6 - An interactive high-level object-oriented language
python3.8 - An interactive high-level object-oriented language

Details

Yebo Cao discovered that Python incorrectly handled certain URLs.
An attacker could use this issue to bypass blockinglisting methods.
This issue was first addressed in USN-5960-1, but was incomplete.
Here we address an additional fix to that issue. (CVE-2023-24329)

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

Ubuntu Release	Package Version
23.04 lunar	python3.11 – 3.11.2-6ubuntu0.1
22.10 kinetic	python3.10 – 3.10.7-1ubuntu0.4
22.04 jammy	python3.10 – 3.10.6-1~22.04.2ubuntu1.1
20.04 focal	python3.8 – 3.8.10-0ubuntu1~20.04.8
18.04 bionic	python2.7 – 2.7.17-1~18.04ubuntu1.13
18.04 bionic	python3.6 – 3.6.9-1~18.04ubuntu1.13
16.04 xenial	python2.7 – 2.7.12-1ubuntu0~16.04.18+esm5
16.04 xenial	python3.5 – 3.5.2-2ubuntu0~16.04.13+esm8
14.04 trusty	python2.7 – 2.7.6-8ubuntu0.6+esm15

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

CVE-2023-24329

CVE-2023-24329

Packages

Details

Update instructions

Reduce your security exposure

References

Related notices