SUSE · security update for python3.9
Affects SUSESource GCVE Database
Not known to be exploited · CVSS 5.5 Medium · fixed in SUSE package updates : update the Red Hat redhat/python3.9 package when convenient.
Data as of 26 Oct 2026, 09:15 UTC
- EPSS
- 1.1% chance of exploitation in 30 days – higher than 65% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 9.8, 9.6, 9.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:LExploitation evidence
Disclosed: evidence found.
CVE published 1 Aug 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade the Red Hat redhat/python3.9 package to 9.8, 9.6 or 9.4.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Red Hatredhat/python3.9pkg:rpm/redhat/python3.9Other threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Security updates addressing this vulnerability are available from Red Hat and Ubuntu. Users should apply the official patches provided by their Linux distribution vendors to remediate the issue. Refer to the Red Hat advisory (RHSA-2024:6163) and Ubuntu security notices for detailed update instructions. No additional mitigations are required beyond applying these patches.
Description
CVE-2024-6923 is a medium severity vulnerability affecting the email module in CPython, including Python 2.7 and other versions. The issue involves improper quoting of newlines in email headers during serialization, which can lead to header injection. Fixes for this vulnerability are available from Red Hat and Ubuntu for affected versions.
References
- access.redhat.com/errata/RHSA-2024:6163 (opens in a new tab)
- access.redhat.com/security/updates/classification/ (opens in a new tab)
- bugzilla.redhat.com/show_bug.cgi?id=2302255 (opens in a new tab)
- security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6163.json (opens in a new tab)
- ubuntu.com/security/CVE-2024-6923 (opens in a new tab)
- cve.org/CVERecord?id=CVE-2024-6923 (opens in a new tab)
- github.com/python/cpython/pull/122233 (opens in a new tab)
- mail.python.org/archives/list/security-announce@python.org/thread/QH3BUOE2DYQBWP7NAQ7UNHPPOELKISRW/ (opens in a new tab)
- ubuntu.com/security/notices/USN-7015-1 (opens in a new tab)
- ubuntu.com/security/notices/USN-7015-5 (opens in a new tab)
- suse.com/support/security/rating/ (opens in a new tab)
- ftp.suse.com/pub/projects/security/csaf/rhsa-2024_6163.json (opens in a new tab)
- lists.suse.com/pipermail/suse-liberty-linux-updates/2024-September/000009.html (opens in a new tab)
- suse.com/security/cve/CVE-2024-6923/ (opens in a new tab)
- suse.com/security/cve/CVE-2024-8088/ (opens in a new tab)