Debian dla-3966 : pypy3 - security update

critical Nessus Plugin ID 211850

Synopsis

The remote Debian host is missing one or more security-related updates.

Description

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3966 advisory.

- ------------------------------------------------------------------------- Debian LTS Advisory DLA-3966-1 [email protected] https://www.debian.org/lts/security/ Andrej Shadura November 26, 2024 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package : pypy3 Version : 7.3.5+dfsg-2+deb11u4 CVE ID : CVE-2020-10735 CVE-2020-29651 CVE-2021-3737 CVE-2021-28861 CVE-2022-0391 CVE-2022-45061 CVE-2023-27043 CVE-2024-9287

Multiple vulnerabilities have been fixed in pypy3, an alternative implementation of the Python 3.x language.

CVE-2020-10735

A flaw was found in Python. In algorithms with quadratic time complexity using non-binary bases, when using int(text), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability.

CVE-2020-29651

A denial of service via regular expression in the py.path.svnwc component of py (aka python-py) through 1.9.0 could be used by attackers to cause a compute-time denial of service attack by supplying malicious input to the blame functionality.
python-py is a part of the pypy3 distribution.

CVE-2021-3737

A flaw was found in Python. An improperly handled HTTP response in the HTTP client code of Python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability.

CVE-2021-28861

Python has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure.
NOTE: this is disputed by a third party because the http.server.html documentation page states Warning: http.server is not recommended for production. It only implements basic security checks.

CVE-2022-0391

A flaw was found in Python within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks.

CVE-2022-45061

An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302.

CVE-2023-27043

The email module of Python incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py.

CVE-2024-9287

A vulnerability has been found in the `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment activation scripts (ie source venv/bin/activate). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren't activated before being used (ie ./venv/bin/python) are not affected.v

For Debian 11 bullseye, these problems have been fixed in version 7.3.5+dfsg-2+deb11u4.

We recommend that you upgrade your pypy3 packages.

For the detailed security status of pypy3 please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/pypy3

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade the pypy3 packages.

Plugin Details

Severity: Critical

ID: 211850

File Name: debian_DLA-3966.nasl

Version: 1.1

Type: local

Agent: unix

Family: Debian Local Security Checks

Published: 11/26/2024

Updated: 11/26/2024

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2022-0391

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: Critical

Base Score: 9.3

Threat Score: 8.9

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2023-27043

Vulnerability Information

CPE: cpe:/o:debian:debian_linux:11.0, p-cpe:/a:debian:debian_linux:pypy3, p-cpe:/a:debian:debian_linux:pypy3-dev, p-cpe:/a:debian:debian_linux:pypy3-doc, p-cpe:/a:debian:debian_linux:pypy3-lib, p-cpe:/a:debian:debian_linux:pypy3-lib-testsuite, p-cpe:/a:debian:debian_linux:pypy3-tk

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/26/2024

Vulnerability Publication Date: 12/9/2020

Reference Information

CVE: CVE-2020-10735, CVE-2020-29651, CVE-2021-28861, CVE-2021-3737, CVE-2022-0391, CVE-2022-45061, CVE-2023-27043, CVE-2024-9287

Detections

Analytics