Threats Tagged 'cve-2024-11168'

The Red Hat Storage Ceph container images are based on the latest ubi9 base image and Ceph 8.1. This release updates to the latest version.

Red Hat Discovery, also known as Discovery, is an inspection and reporting tool that finds, identifies, and reports environment data, or facts, such as the number of physical and virtual systems on a network, their operating systems, and relevant configuration data stored within them. Discovery also identifies and reports more detailed facts for some versions of key Red Hat packages and products that it finds in the network.

CVE-2024-9287 is a vulnerability in the Python CPython venv module where activation scripts do not properly quote path names. This allows an attacker who creates a malicious virtual environment to inject commands that execute when the environment is activated using the 'source venv/bin/activate' command. Virtual environments created by trusted users or those used without activation (e.g., directly invoking the Python binary) are not affected. The issue affects multiple Python versions from 3.6.8 through versions prior to fixed releases in 3.9.21, 3.10.16, 3.11.11, 3.12.8, and 3.13.1. A patch is available and has been issued by Red Hat and other vendors. The severity is assessed as medium.

The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser.

MediumVulnerabilityGermanyFranceUnited Kingdom+4#cve#cve-2024-11168

A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at the same time as certificates are loaded into the SSLContext, such as during the TLS handshake with a certificate directory configured. This issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5.