[CLSA-2024:1727895277] Fix CVE(s): CVE-2024-6232, CVE-2024-7592
Type:
security
Severity:
Important
Release date:
2024-10-02 18:54:40 UTC
Description:
* SECURITY UPDATE: Excessive CPU resources usage while parsing cookies with backslashes in value - debian/patches/CVE-2024-7592.patch: Fix quadratic complexity in parsing cookie values with backslashes - CVE-2024-7592 * SECURITY UPDATE: Regular expressions that allowed excessive backtracking during tarfile header parsing - debian/patches/CVE-2024-6232.patch: Fix regexp handling in tarfile - CVE-2024-6232 * Replace PROTOCOL_TLSv1 with PROTOCOL_TLSv1_2 in Lib/test/test_ssl.py to fix the check phase on the build system
Updated packages:
  • idle-python2.7_2.7.17-1~18.04ubuntu1.11+tuxcare.els9_all.deb
    sha:784d2caafdc205d48e21572e63ea7d8b0664d8eb
  • libpython2.7_2.7.17-1~18.04ubuntu1.11+tuxcare.els9_amd64.deb
    sha:44c5b70707761823edf7aeacdb9bc58191ae2812
  • libpython2.7-dev_2.7.17-1~18.04ubuntu1.11+tuxcare.els9_amd64.deb
    sha:ab625f241c372e7397707a23e6929fd0cadc6b20
  • libpython2.7-minimal_2.7.17-1~18.04ubuntu1.11+tuxcare.els9_amd64.deb
    sha:96d90efd130ff120a0e61ffb40a5aa35dd7ee425
  • libpython2.7-stdlib_2.7.17-1~18.04ubuntu1.11+tuxcare.els9_amd64.deb
    sha:8c86583ceaec36555ba635fb15e7242b9b05aaf0
  • libpython2.7-testsuite_2.7.17-1~18.04ubuntu1.11+tuxcare.els9_all.deb
    sha:ee8ba679865f1fa8b770be411114ea450d70cef3
  • python2.7_2.7.17-1~18.04ubuntu1.11+tuxcare.els9_amd64.deb
    sha:8928c073054e16cb7ee9b3d3be3763fae6dfc527
  • python2.7-dev_2.7.17-1~18.04ubuntu1.11+tuxcare.els9_amd64.deb
    sha:8ef4bb2e74362fb9892ef8b260c9e3ecb7db3a3a
  • python2.7-doc_2.7.17-1~18.04ubuntu1.11+tuxcare.els9_all.deb
    sha:e57d52b50c7a3351fb7dbd7c45589ca8a981f364
  • python2.7-examples_2.7.17-1~18.04ubuntu1.11+tuxcare.els9_all.deb
    sha:e7f30ad075a2dea9974ffbdbca8f3ae651642ce5
  • python2.7-minimal_2.7.17-1~18.04ubuntu1.11+tuxcare.els9_amd64.deb
    sha:f9c6073d90f5381ab7fc8627363706e2a7f47feb
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.