FlawAtlas
Search the atlas
SUSE-SU-2023:2937-1 Not scored

Security update for python311

This update for python311 fixes the following issues: python was updated to version 3.11.4: - CVE-2023-24329: Fixed blocklist bypass via the urllib.parse component when supplying a URL that starts with blank characters (bsc#1208471). - CVE-2007-4559: Fixed python tarfile module directory traversal (bsc#1203750). - Fixed a security in flaw in uu.decode() that could allow for directory traversal based on the input if no out_file was specified. - Do not expose the local on-disk location in directory indexes produced by http.client.SimpleHTTPRequestHandler. Bugfixes: - trace.__main__ now uses io.open_code() for files to be executed instead of raw open().

Exploit probability Not scored
Published July 21, 2023
Required by Not available
Last source change February 4, 2026

02 / AFFECTED SOFTWARE

Affected packages

SUSE:Linux Enterprise Module for Python 3 15 SP4 python311
SUSE:Linux Enterprise Module for Python 3 15 SP4 python311-core
SUSE:Linux Enterprise Module for Python 3 15 SP4 python311-documentation
SUSE:Linux Enterprise Module for Python 3 15 SP5 python311
SUSE:Linux Enterprise Module for Python 3 15 SP5 python311-core
SUSE:Linux Enterprise Module for Python 3 15 SP5 python311-documentation
openSUSE:Leap 15.4 python311
openSUSE:Leap 15.4 python311-core
openSUSE:Leap 15.4 python311-documentation
openSUSE:Leap 15.5 python311
openSUSE:Leap 15.5 python311-core
openSUSE:Leap 15.5 python311-documentation

03 / CONNECTIONS

Connected vulnerabilities

04 / EVIDENCE

Source records

Open Source Vulnerabilities SUSE-SU-2023:2937-1

This update for python311 fixes the following issues: python was updated to version 3.11.4: - CVE-2023-24329: Fixed blocklist bypass via the urllib.parse component when supplying a URL that starts with blank characters (bsc#1208471). - CVE-2007-4559: Fixed python tarfile module directory traversal (bsc#1203750). - Fixed a security in flaw in uu.decode() that could allow for directory traversal based on the input if no out_file was specified. - Do not expose the local on-disk location in directory indexes produced by http.client.SimpleHTTPRequestHandler. Bugfixes: - trace.__main__ now uses io.open_code() for files to be executed instead of raw open().

View original source

05 / REFERENCES

Further evidence