OmniData算子下推

Python

3.11.4

HWPSIRT-2023-03320

CVE-2023-41105

7.5

An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.normpath(), the path will be truncated unexpectedly at the first '\0' byte. There are plausible cases in which an application would have rejected a filename for security reasons in Python 3.10.x or earlier, but that filename is no longer rejected in Python 3.11.x.

Kunpeng BoostKit 24.0.0

Python

3.11.4

HWPSIRT-2024-69283

CVE-2024-0397

7.4

A defect was discovered in the Python “ssl” module where there is a memory

race condition with the ssl.SSLContext methods “cert_store_stats()” and

“get_ca_certs()”. The race condition can be triggered if the methods are

called at the same time as certificates are loaded into the SSLContext,

such as during the TLS handshake with a certificate directory configured.

This issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5.

Kunpeng BoostKit 24.0.0

Python

3.11.4

HWPSIRT-2024-34558

CVE-2023-6597

7.8

An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior.

The tempfile.TemporaryDirectory class would dereference symlinks during cleanup of permissions-related errors. This means users which can run privileged programs are potentially able to modify permissions of files referenced by symlinks in some circumstances.

Kunpeng BoostKit 24.0.0

Python

3.11.4

HWPSIRT-2024-01158

CVE-2024-7592

7.5

There is a LOW severity vulnerability affecting CPython, specifically the

'http.cookies' standard library module.

When parsing cookies that contained backslashes for quoted characters in

the cookie value, the parser would use an algorithm with quadratic

complexity, resulting in excess CPU resources being used while parsing the

value.

Kunpeng BoostKit 24.0.0

Python

3.11.4

HWPSIRT-2023-92374

CVE-2023-40217

5.3

An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If a TLS server-side socket is created, receives data into the socket buffer, and then is closed quickly, there is a brief window where the SSLSocket instance will detect the socket as "not connected" and won't initiate a handshake, but buffered data will still be readable from the socket buffer. This data will not be authenticated if the server-side TLS peer is expecting client certificate authentication, and is indistinguishable from valid TLS stream data. Data is limited in size to the amount that will fit in the buffer. (The TLS connection cannot directly be used for data exfiltration because the vulnerable code path requires that the connection be closed on initialization of the SSLSocket.)

Kunpeng BoostKit 24.0.0

Python

3.11.4

HWPSIRT-2023-73521

CVE-2023-27043

5.3

The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python.

Kunpeng BoostKit 24.0.0

Python

3.11.4

HWPSIRT-2024-51481

CVE-2024-0450

6.2

An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior.

The zipfile module is vulnerable to “quoted-overlap” zip-bombs which exploit the zip format to create a zip-bomb with a high compression ratio. The fixed versions of CPython makes the zipfile module reject zip archives which overlap entries in the archive.

Kunpeng BoostKit 24.0.0

Python

3.11.4

HWPSIRT-2024-68388

CVE-2024-6232

7.5

There is a MEDIUM severity vulnerability affecting CPython.

Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.

Kunpeng BoostKit 24.0.0

openEuler:openssl

1.1.1wa-2.oe2203sp3

HWPSIRT-2024-07658

CVE-2024-9143

4.3

Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted

explicit values for the field polynomial can lead to out-of-bounds memory reads

or writes.

Impact summary: Out of bound memory writes can lead to an application crash or

even a possibility of a remote code execution, however, in all the protocols

involving Elliptic Curve Cryptography that we're aware of, either only "named

curves" are supported, or, if explicit curve parameters are supported, they

specify an X9.62 encoding of binary (GF(2^m)) curves that can't represent

problematic input values. Thus the likelihood of existence of a vulnerable

application is low.

In particular, the X9.62 encoding is used for ECC keys in X.509 certificates,

so problematic inputs cannot occur in the context of processing X.509

certificates. Any problematic use-cases would have to be using an "exotic"

curve encoding.

The affected APIs include: EC_GROUP_new_curve_GF2m(), EC_GROUP_new_from_params(),

and various supporting BN_GF2m_*() functions.

Applications working with "exotic" explicit binary (GF(2^m)) curve parameters,

that make it possible to represent invalid field polynomials with a zero

constant term, via the above or similar APIs, may terminate abruptly as a

result of reading or writing outside of array bounds. Remote code execution

cannot easily be ruled out.

The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.

Kunpeng BoostKit 24.0.0

openEuler:openssl

1.1.1wa-2.oe2203sp3

HWPSIRT-2024-55293

CVE-2024-5535

9.1

Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an

empty supported client protocols buffer may cause a crash or memory contents to

be sent to the peer.

Impact summary: A buffer overread can have a range of potential consequences

such as unexpected application beahviour or a crash. In particular this issue

could result in up to 255 bytes of arbitrary private data from memory being sent

to the peer leading to a loss of confidentiality. However, only applications

that directly call the SSL_select_next_proto function with a 0 length list of

supported client protocols are affected by this issue. This would normally never

be a valid scenario and is typically not under attacker control but may occur by

accident in the case of a configuration or programming error in the calling

application.

The OpenSSL API function SSL_select_next_proto is typically used by TLS

applications that support ALPN (Application Layer Protocol Negotiation) or NPN

(Next Protocol Negotiation). NPN is older, was never standardised and

is deprecated in favour of ALPN. We believe that ALPN is significantly more

widely deployed than NPN. The SSL_select_next_proto function accepts a list of

protocols from the server and a list of protocols from the client and returns

the first protocol that appears in the server list that also appears in the

client list. In the case of no overlap between the two lists it returns the

first item in the client list. In either case it will signal whether an overlap

between the two lists was found. In the case where SSL_select_next_proto is

called with a zero length client list it fails to notice this condition and

returns the memory immediately following the client list pointer (and reports

that there was no overlap in the lists).

This function is typically called from a server side application callback for

ALPN or a client side application callback for NPN. In the case of ALPN the list

of protocols supplied by the client is guaranteed by libssl to never be zero in

length. The list of server protocols comes from the application and should never

normally be expected to be of zero length. In this case if the

SSL_select_next_proto function has been called as expected (with the list

supplied by the client passed in the client/client_len parameters), then the

application will not be vulnerable to this issue. If the application has

accidentally been configured with a zero length server list, and has

accidentally passed that zero length server list in the client/client_len

parameters, and has additionally failed to correctly handle a "no overlap"

response (which would normally result in a handshake failure in ALPN) then it

will be vulnerable to this problem.

In the case of NPN, the protocol permits the client to opportunistically select

a protocol when there is no overlap. OpenSSL returns the first client protocol

in the no overlap case in support of this. The list of client protocols comes

from the application and should never normally be expected to be of zero length.

However if the SSL_select_next_proto function is accidentally called with a

client_len of 0 then an invalid memory pointer will be returned instead. If the

application uses this output as the opportunistic protocol then the loss of

confidentiality will occur.

This issue has been assessed as Low severity because applications are most

likely to be vulnerable if they are using NPN instead of ALPN - but NPN is not

widely used. It also requires an application configuration or programming error.

Finally, this issue would not typically be under attacker control making active

exploitation unlikely.

The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.

Due to the low severity of this issue we are not issuing new releases of

OpenSSL at this time. The fix will be included in the next releases when they

become available.

Kunpeng BoostKit 24.0.RC3