Detections
Analytics
Alpine: python3: security update to 3.10.14-r0
high Tenable Cloud Security Plugin ID 408322
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7,
3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference symlinks
during cleanup of permissions-related errors. This means users which can run privileged programs are
potentially able to modify permissions of files referenced by symlinks in some circumstances.
(CVE-2023-6597)
- An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and
3.8.18 and prior. The zipfile module is vulnerable to “quoted-overlap” zip-bombs which exploit the zip
format to create a zip-bomb with a high compression ratio. The fixed versions of CPython makes the zipfile
module reject zip archives which overlap entries in the archive. (CVE-2024-0450)
See Also
Plugin Details
Severity: High
ID: 408322
Version: Revision 1.14
Type: Local
Published: 3/22/2024
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.8
Percentile: 56.9
CVSS v2
Risk Factor: High
Base Score: 7.2
Temporal Score: 5.3
Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2023-6597
CVSS v3
Risk Factor: High
Base Score: 7.8
Temporal Score: 6.8
Vector: CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 3/19/2024
Reference Information
CVE: CVE-2023-6597, CVE-2024-0450