This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============1434202300357536660==
Content-Language: en-US
Content-Type: multipart/signed; micalg=pgp-sha256;
 protocol="application/pgp-signature";
 boundary="------------IloE0Tz0dVt1A0Dvw38fAVtK"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--------------IloE0Tz0dVt1A0Dvw38fAVtK
Content-Type: multipart/mixed;
 boundary="------------1m0scBLCYCK77sxwv160YqRE";
 protected-headers="v1"
From: Fabian Toepfer <fabian.toepfer@canonical.com>
Reply-To: Ubuntu Security <security@ubuntu.com>
To: ubuntu-security-announce@lists.ubuntu.com
Message-ID: <8aabfe0f-a03c-43d1-99a1-a6752bddc94b@canonical.com>
Subject: [USN-7348-1] Python vulnerabilities

--------------1m0scBLCYCK77sxwv160YqRE
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: base64

==========================================================================
Ubuntu Security Notice USN-7348-1
March 12, 2025

python3.5, python3.8 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 20.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in Python.

Software Description:
- python3.8: An interactive high-level object-oriented language
- python3.5: An interactive high-level object-oriented language

Details:

It was discovered that the Python ipaddress module contained incorrect
information about which IP address ranges were considered “private” or
“globally reachable”. This could possibly result in applications applying
incorrect security policies. This issue only affected Ubuntu 14.04 LTS
and Ubuntu 16.04 LTS. (CVE-2024-4032)

It was discovered that Python incorrectly handled quoting path names when
using the venv module. A local attacker able to control virtual
environments could possibly use this issue to execute arbitrary code when
the virtual environment is activated. (CVE-2024-9287)

It was discovered that Python incorrectly handled parsing bracketed hosts.
A remote attacker could possibly use this issue to perform a Server-Side
Request Forgery (SSRF) attack. This issue only affected Ubuntu 14.04 LTS
and Ubuntu 16.04 LTS. (CVE-2024-11168)

It was discovered that Python incorrectly handled parsing domain names that
included square brackets. A remote attacker could possibly use this issue
to perform a Server-Side Request Forgery (SSRF) attack. (CVE-2025-0938)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS
   python3.8                       3.8.10-0ubuntu1~20.04.16
   python3.8-minimal               3.8.10-0ubuntu1~20.04.16
   python3.8-venv                  3.8.10-0ubuntu1~20.04.16

Ubuntu 16.04 LTS
   python3.5                       3.5.2-2ubuntu0~16.04.13+esm16
                                   Available with Ubuntu Pro
   python3.5-minimal               3.5.2-2ubuntu0~16.04.13+esm16
                                   Available with Ubuntu Pro
   python3.5-venv                  3.5.2-2ubuntu0~16.04.13+esm16
                                   Available with Ubuntu Pro

Ubuntu 14.04 LTS
   python3.5 3.5.2-2ubuntu0~16.04.4~14.04.1+esm4
                                   Available with Ubuntu Pro
   python3.5-minimal 3.5.2-2ubuntu0~16.04.4~14.04.1+esm4
                                   Available with Ubuntu Pro
   python3.5-venv 3.5.2-2ubuntu0~16.04.4~14.04.1+esm4
                                   Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
   https://ubuntu.com/security/notices/USN-7348-1
   CVE-2024-11168, CVE-2024-4032, CVE-2024-9287, CVE-2025-0938

Package Information:
https://launchpad.net/ubuntu/+source/python3.8/3.8.10-0ubuntu1~20.04.16

--------------1m0scBLCYCK77sxwv160YqRE--

--------------IloE0Tz0dVt1A0Dvw38fAVtK
Content-Type: application/pgp-signature; name="OpenPGP_signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="OpenPGP_signature.asc"

-----BEGIN PGP SIGNATURE-----

wsF5BAABCAAjFiEE2WgtvmwmcgaEBLlnCAvK1QvD6SAFAmfRnSMFAwAAAAAACgkQCAvK1QvD6SCv
gw//Qqzq2+TcVPgRgx/57dp4m4A8iFWQakvxLYCbgKjLxAJ0y5jWrVjDSJOgMTlQZUREdLRNWKZr
9I7zIXnwPL3pmhkHafNqe0Jm2uMZ+/UqjzbqefAxD9nz4aLCGVUm/fxkiPe0JtnwY8joXtF7sbUt
tbexuFt4yWXDyr82/E492OdOO/gAJqZ0IX2zy5GRteOMxWSrhy7b2WNTqu2wKH/v4O8ULm8wRwRv
p487xrO/OqeuMxUvSFwATSXkR51eU9gISfS9eJ5QHkDIzRQQY9nsw0QLPhV/t4PrW7x5xYnoVzSt
Suaxc/2jqUAoJYKbCLkM+Snb0VOJILHY7Lk7cJpJxgcOSW4SLB//Q+nqOFnkvZL5Elt0Bvn8CNKB
Onmud/AN9EVvmEXtvDrxzu0nvjJd//9W2BqD6917egujrB9X79QElyYZYAMJgJanHNK1M8D32Df1
WIC4O2HlPW3Z/P8/wM8IXPufMx7TdJw+dESiZq25Dr2PuJO/0fjuZzTKtdrQlH0WQoq4pZIaKwGx
7bpTz1FuNhRhwVNtC1fFYCVXbmzKDGEzD/2ZQMZtxgJytP48EVzB+EmGd/AU4vBD18284kBGqno6
GmPE0RworOPxny8+ffvnhf4YLqXI4Oi+DyRwWNVZ/9LtAwstIMRp4ozpuL3USkd66hUMvN3MP8N1
ucs=
=9nrx
-----END PGP SIGNATURE-----

--------------IloE0Tz0dVt1A0Dvw38fAVtK--


--===============1434202300357536660==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

Cg==

--===============1434202300357536660==--