It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-788 advisory.

    The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special     character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some     applications, an attacker can bypass a protection mechanism in which application access is granted only     after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be     used for signup). This occurs in email/_parseaddr.py in recent versions of Python. (CVE-2023-27043)

    A defect was discovered in the Python ssl module where there is a memoryrace condition with the     ssl.SSLContext methods cert_store_stats() andget_ca_certs(). The race condition can be triggered if     the methods arecalled at the same time as certificates are loaded into the SSLContext,such as during the     TLS handshake with a certificate directory configured.This issue is fixed in CPython 3.10.14, 3.11.9,     3.12.3, and 3.13.0a5. (CVE-2024-0397)

    There is a severity vulnerability affecting the CPython zipfilemodule.

    When iterating over names of entries in a zip archive (for example, methodsof zipfile.ZipFile like     namelist(), iterdir(), extractall(), etc)the process can be put into an infinite loop with a     maliciously craftedzip archive. This defect applies when reading only metadata or extractingthe contents     of the zip archive. Programs that are not handlinguser-controlled zip archives are not affected.
    (CVE-2024-8088)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2023 : python3.11, python3.11-devel, python3.11-idle (ALAS2023-2024-788)

high Nessus Plugin ID 212358

Version 1.2