Red Hat Security Advisory: python3.12 security update
Python 3.12 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.12 package provides the "python3.12" executable: the reference interpreter for the Python language, version 3. The majority of its standard library is provided in the python3.12-libs package, which should be installed automatically along with python3.12. The remaining parts of the Python standard library are broken out into the python3.12-tkinter and python3.12-test packages, which may need to be installed separately. Documentation for Python is provided in the python3.12-docs package. Packages containing additional libraries for Python are generally named with the "python3.12-" prefix. Security Fix(es): * python: The zipfile module is vulnerable to zip-bombs leading to denial of service (CVE-2024-0450) * python: incorrect IPv4 and IPv6 private ranges (CVE-2024-4032) * python: cpython: Iterating over a malicious ZIP file may lead to Denial of Service (CVE-2024-8088) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.5 Release Notes linked from the References section.
AI Analysis
Technical Summary
Red Hat Product Security issued an advisory (RHSA-2024:9190) for python3.12 on Red Hat Enterprise Linux 9, addressing multiple vulnerabilities: CVE-2024-0450 and CVE-2024-8088 involve denial of service via zip-bomb and malicious ZIP file iteration in the zipfile module; CVE-2024-4032 concerns incorrect IPv4 and IPv6 private address range handling. These vulnerabilities affect the python3.12 interpreter and its standard libraries. The advisory provides updated packages to fix these issues. No CVSS scores are provided in the advisory, but the impact is rated moderate by Red Hat. The update is available for various architectures and extended update support versions of Red Hat Enterprise Linux 9 and CodeReady Linux Builder 9.
Potential Impact
The vulnerabilities can cause denial of service conditions when processing specially crafted ZIP files, potentially leading to resource exhaustion. Incorrect private IP range handling may cause network-related misbehavior or security policy bypass. No known exploits in the wild have been reported. The overall impact is moderate, primarily affecting availability and network correctness.
Mitigation Recommendations
Red Hat has released updated python3.12 packages that address these vulnerabilities. Users should apply the official Red Hat update RHSA-2024:9190 for Red Hat Enterprise Linux 9 and related products to remediate these issues. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigations are specified or required beyond applying the vendor-provided update.
Red Hat Security Advisory: python3.12 security update
Description
Python 3.12 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.12 package provides the "python3.12" executable: the reference interpreter for the Python language, version 3. The majority of its standard library is provided in the python3.12-libs package, which should be installed automatically along with python3.12. The remaining parts of the Python standard library are broken out into the python3.12-tkinter and python3.12-test packages, which may need to be installed separately. Documentation for Python is provided in the python3.12-docs package. Packages containing additional libraries for Python are generally named with the "python3.12-" prefix. Security Fix(es): * python: The zipfile module is vulnerable to zip-bombs leading to denial of service (CVE-2024-0450) * python: incorrect IPv4 and IPv6 private ranges (CVE-2024-4032) * python: cpython: Iterating over a malicious ZIP file may lead to Denial of Service (CVE-2024-8088) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.5 Release Notes linked from the References section.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Red Hat Product Security issued an advisory (RHSA-2024:9190) for python3.12 on Red Hat Enterprise Linux 9, addressing multiple vulnerabilities: CVE-2024-0450 and CVE-2024-8088 involve denial of service via zip-bomb and malicious ZIP file iteration in the zipfile module; CVE-2024-4032 concerns incorrect IPv4 and IPv6 private address range handling. These vulnerabilities affect the python3.12 interpreter and its standard libraries. The advisory provides updated packages to fix these issues. No CVSS scores are provided in the advisory, but the impact is rated moderate by Red Hat. The update is available for various architectures and extended update support versions of Red Hat Enterprise Linux 9 and CodeReady Linux Builder 9.
Potential Impact
The vulnerabilities can cause denial of service conditions when processing specially crafted ZIP files, potentially leading to resource exhaustion. Incorrect private IP range handling may cause network-related misbehavior or security policy bypass. No known exploits in the wild have been reported. The overall impact is moderate, primarily affecting availability and network correctness.
Mitigation Recommendations
Red Hat has released updated python3.12 packages that address these vulnerabilities. Users should apply the official Red Hat update RHSA-2024:9190 for Red Hat Enterprise Linux 9 and related products to remediate these issues. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigations are specified or required beyond applying the vendor-provided update.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2024:9190
- Cve Count
- 4
- Additional Cves
- ["CVE-2024-0450","CVE-2024-4032","CVE-2024-8088"]
Threat ID: 6a3da1ec4853345fc18308fb
Added to database: 06/25/2026, 21:47:24 UTC
Last enriched: 07/04/2026, 01:24:39 UTC
Last updated: 09/10/2026, 19:24:53 UTC
Views: 77
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.