- -------------------------------------------------------------------------
Debian LTS Advisory DLA-3948-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                       Andrej Shadura
November 07, 2024                             https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : pypy3
Version        : 7.3.5+dfsg-2+deb11u3
CVE ID         : CVE-2023-6597 CVE-2023-24329 CVE-2023-40217 CVE-2024-0450
Debian Bug     : 

Brief introduction 

CVE-2023-6597

    An issue was found in the CPython `tempfile.TemporaryDirectory` class
    affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and
    prior. The tempfile.TemporaryDirectory class would dereference
    symlinks during cleanup of permissions-related errors. This means
    users which can run privileged programs are potentially able to modify
    permissions of files referenced by symlinks in some circumstances.

CVE-2023-24329

    An issue in the urllib.parse component of Python before 3.11.4 allows
    attackers to bypass blocklisting methods by supplying a URL that starts
    with blank characters.

CVE-2023-40217

    An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18,
    3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects
    servers (such as HTTP servers) that use TLS client authentication. If
    a TLS server-side socket is created, receives data into the socket
    buffer, and then is closed quickly, there is a brief window where
    the SSLSocket instance will detect the socket as "not connected" and
    won't initiate a handshake, but buffered data will still be readable
    from the socket buffer. This data will not be authenticated if the
    server-side TLS peer is expecting client certificate authentication,
    and is indistinguishable from valid TLS stream data. Data is limited
    in size to the amount that will fit in the buffer. (The TLS connection
    cannot directly be used for data exfiltration because the vulnerable
    code path requires that the connection be closed on initialization
    of the SSLSocket.)

CVE-2024-0450

    An issue was found in the CPython `zipfile` module affecting versions
    3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The zipfile
    module is vulnerable to “quoted-overlap” zip-bombs which exploit
    the zip format to create a zip-bomb with a high compression ratio. The
    fixed versions of CPython makes the zipfile module reject zip archives
    which overlap entries in the archive.

For Debian 11 bullseye, these problems have been fixed in version
7.3.5+dfsg-2+deb11u3.

We recommend that you upgrade your pypy3 packages.

For the detailed security status of pypy3 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/pypy3

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS