SUSE-SU-2024:0436-1: Security update for python36
This update for python36 fixes the following issues: CVE-2023-27043: Fixed incorrectly parses e-mail addresses which contain a special character (bsc#1210638).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/python36-develto a version that resolves this vulnerability.Fixed in 3.6.15-52.1 - Upgrade
Upgrade
suse/python36to a version that resolves this vulnerability.Fixed in 3.6.15-52.1 - Upgrade
Upgrade
suse/python36-debugsourceto a version that resolves this vulnerability.Fixed in 3.6.15-52.1 - Upgrade
Upgrade
suse/python36-base-debuginfoto a version that resolves this vulnerability.Fixed in 3.6.15-52.1 - Upgrade
Upgrade
suse/python36-debuginfoto a version that resolves this vulnerability.Fixed in 3.6.15-52.1 - Upgrade
Upgrade
suse/python36-baseto a version that resolves this vulnerability.Fixed in 3.6.15-52.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-SDK-12-SP5-2024-436=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-SERVER-12-SP5-2024-436=1
Event History
Frequently Asked Questions
Which deployed systems are covered by this update?
The update applies to python36 packages on SUSE Linux Enterprise Software Development Kit 12 SP5 for aarch64, ppc64le, s390x, and x86_64, and on SUSE Linux Enterprise High Performance Computing 12 SP5 for aarch64 and x86_64. Listed packages include python36, python36-base, python36-devel, debugsource, and debuginfo variants.
What application behavior could expose a system to this issue?
Exposure depends on software using Python 3.6 to parse e-mail addresses containing a special character. The provided information does not identify a network-reachable service, default-enabled component, or specific attack prerequisites.