Linux · Security advisory · November 9, 2021

RLSA-2021:4160: Security update for 4 packages

RLSA-2021:4160, released November 9, 2021, fixes 7 CVEs across 4 products. None of them is reported as exploited. Patch Radar priority: High.

High

CVEs closed

None rated Critical

Exploited

None reported

Exploitation more likely

Vendor assessment

Highest EPSS

0.1317

96th percentile

Priority of the 7 CVEs

Patch now 0
                                Urgent 0
                                High 7
                                Routine 0

Fixed package versions

Product	Release	Fixed in
pybind11	rocky 8	0:2.6.1-2.module+el8.4.0+574+843c4898
python-iniconfig	rocky 8	0:1.1.1-2.module+el8.4.0+574+843c4898
python-toml	rocky 8	0:0.10.1-5.module+el8.4.0+574+843c4898
python39	rocky 8	0:3.9.6-2.module+el8.5.0+673+10283621

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
High	CVE-2021-3737	Python 3.8 and 2 others: Loop with Unreachable Exit Condition ('Infinite Loop'), CWE-400 - Uncontrolled Resource Consumption	9.1	0.1317	None reported
High	CVE-2021-29921	Python 3.8: In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an…	9.8	0.0676	None reported
High	CVE-2021-3733	Python 3.7 and 5 others: Uncontrolled Resource Consumption	9.1	0.0480	None reported
High	CVE-2021-28957	python39-rpm-macros: Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, excepti...	9.1	0.0404	None reported
High	CVE-2021-33503	python39-wcwidth: Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, excepti...	9.1	0.0327	None reported
High	CVE-2021-3426	Python 3.7 and 3 others: There's a flaw in Python 3's pydoc.	9.1	0.0186	None reported
High	CVE-2021-3572	python39-urllib3: Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, excepti...	9.1	0.0183	None reported

Also fixes CVE-2021-3737

ELSA-2021-4160
python39, python39-Cython, python39-PyMySQL and 46 more on ol 8
ALSA-2021:4160
python39-Cython, python39-PyMySQL, python39-attrs and 33 more on almalinux 8
RHSA-2021:4160
python39, python39-Cython, python39-PyMySQL and 46 more on RHEL 8
ELSA-2022-1821
babel, python-nose-docs, python-psycopg2-doc and 59 more on ol 8
ALSA-2022:1821
babel, python-nose-docs, python-psycopg2-doc and 59 more on almalinux 8
RLSA-2022:1821
Cython, PyYAML, babel and 39 more on rocky 8
RHSA-2022:1821
babel, python-nose-docs, python-psycopg2-doc and 59 more on RHEL 8
ELSA-2022-1764
python38, python38-Cython, python38-PyMySQL and 48 more on ol 8

Vendor advisory

https://errata.rockylinux.org/RLSA-2021:4160

For tools and AI agents

This page as data: JSON · Markdown

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo