Detections
Analytics
Alpine: multiple pyc packages, multiple python3 packages: security update to 3.11.10-r0
medium Tenable Cloud Security Plugin ID 408510
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special
character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some
applications, an attacker can bypass a protection mechanism in which application access is granted only
after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be
used for signup). This occurs in email/_parseaddr.py in recent versions of Python. (CVE-2023-27043)
- The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were
designated as “globally reachable” or “private”. This affected the is_private and is_global properties of
the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network
classes, where values wouldn’t be returned in accordance with the latest information from the IANA
Special-Purpose Address Registries. CPython 3.12.4 and 3.13.0a6 contain updated information from these
registries and thus have the intended behavior. (CVE-2024-4032)
- There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive
backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar
archives. (CVE-2024-6232)
- There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote
newlines for email headers when serializing an email message allowing for header injection when an email
is serialized. (CVE-2024-6923)
- There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library
module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the
parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used
while parsing the value. (CVE-2024-7592)
See Also
https://security.alpinelinux.org/vuln/CVE-2015-2104
https://security.alpinelinux.org/vuln/CVE-2023-27043
https://security.alpinelinux.org/vuln/CVE-2024-4032
https://security.alpinelinux.org/vuln/CVE-2024-6232
Plugin Details
Severity: Medium
ID: 408510
Version: Revision 1.6
Type: Local
Published: 9/11/2024
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 5
Percentile: 94.39
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.9
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N
CVSS Score Source: CVE-2023-27043
CVSS v3
Risk Factor: Medium
Base Score: 5.3
Temporal Score: 4.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Vulnerability Publication Date: 4/18/2023
Reference Information
CVE: CVE-2023-27043, CVE-2024-4032, CVE-2024-6232, CVE-2024-6923, CVE-2024-7592
IAVA: 2023-A-0442-S