Linux · Rocky Linux · Security advisory · May 7, 2025

RLSA-2024:2987: Security update for 42 packages

RLSA-2024:2987, released May 7, 2025, fixes 5 CVEs across 42 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
5
None rated Critical
Exploited
0
None reported
Highest CVSS
9.8
Base score, 0 to 10
Highest EPSS
0.0523
92nd percentile

Priority of the 5 CVEs

Patch now 0 Urgent 0 High 5 Routine 0

Fixed package versions

ProductReleaseFixed in
Cythonrocky 80:0.28.1-7.module+el8.9.0+1531+a18208f5
PyYAMLrocky 80:3.12-16.module+el8.9.0+1531+a18208f5
babelrocky 80:2.5.1-10.module+el8.9.0+1531+a18208f5
numpyrocky 81:1.14.2-16.module+el8.9.0+1531+a18208f5
pytestrocky 80:3.4.2-13.module+el8.9.0+1531+a18208f5
python-PyMySQLrocky 80:0.8.0-10.module+el8.9.0+1531+a18208f5
python-attrsrocky 80:17.4.0-10.module+el8.9.0+1531+a18208f5
python-backportsrocky 80:1.0-16.module+el8.9.0+1531+a18208f5
python-backports-ssl_match_hostnamerocky 80:3.5.0.1-12.module+el8.9.0+1531+a18208f5
python-chardetrocky 80:3.0.4-10.module+el8.9.0+1531+a18208f5
python-coveragerocky 80:4.5.1-5.module+el8.10.0+1817+0b01df83
python-dnsrocky 80:1.15.0-10.module+el8.9.0+1531+a18208f5
python-docsrocky 80:2.7.16-2.module+el8.9.0+1531+a18208f5
python-docutilsrocky 80:0.14-12.module+el8.10.0+1592+61442852
python-funcsigsrocky 80:1.0.2-13.module+el8.9.0+1531+a18208f5
python-idnarocky 80:2.5-7.module+el8.9.0+1531+a18208f5
python-ipaddressrocky 80:1.0.18-6.module+el8.9.0+1531+a18208f5
python-jinja2rocky 80:2.10-10.module+el8.10.0+1813+4b021305
python-lxmlrocky 80:4.2.3-6.module+el8.9.0+1531+a18208f5
python-markupsaferocky 80:0.23-19.module+el8.9.0+1531+a18208f5
python-mockrocky 80:2.0.0-13.module+el8.9.0+1531+a18208f5
python-noserocky 80:1.3.7-31.module+el8.10.0+1592+61442852
python-pluggyrocky 80:0.6.0-8.module+el8.9.0+1531+a18208f5
python-psycopg2rocky 80:2.7.5-8.module+el8.10.0+1817+0b01df83
python-pyrocky 80:1.5.3-6.module+el8.9.0+1531+a18208f5
python-pygmentsrocky 80:2.2.0-22.module+el8.10.0+1592+61442852
python-pymongorocky 80:3.7.0-1.module+el8.10.0+1592+61442852
python-pysocksrocky 80:1.6.8-6.module+el8.9.0+1531+a18208f5
python-pytest-mockrocky 80:1.9.0-4.module+el8.9.0+1531+a18208f5
python-requestsrocky 80:2.20.0-4.module+el8.10.0+1817+0b01df83
python-setuptools_scmrocky 80:1.15.7-6.module+el8.9.0+1531+a18208f5
python-sqlalchemyrocky 80:1.3.2-2.module+el8.9.0+1531+a18208f5
python-urllib3rocky 80:1.24.2-4.module+el8.10.0+1813+4b021305
python-virtualenvrocky 80:15.1.0-22.module+el8.10.0+1592+61442852
python-wheelrocky 81:0.31.1-3.module+el8.10.0+1592+61442852
python2rocky 80:2.7.18-17.module+el8.10.0+1813+4b021305.rocky.0.2
python2-piprocky 80:9.0.3-19.module+el8.9.0+1531+a18208f5
python2-rpm-macrosrocky 80:3-38.module+el8.9.0+1531+a18208f5
python2-setuptoolsrocky 80:39.0.1-14.module+el8.10.0+1813+4b021305
python2-sixrocky 80:1.11.0-6.module+el8.9.0+1531+a18208f5
pytzrocky 80:2017.2-13.module+el8.10.0+1817+0b01df83
scipyrocky 80:1.0.0-22.module+el8.10.0+1817+0b01df83

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
High CVE-2022-48565 Python 3.7 and 4 others: An XML External Entity (XXE) issue was discovered in Python through 3.9.1.9.8 0.0523 None reported
High CVE-2022-40897 python3-setuptools-wheel: The python-setuptools package provides a collection of enhancements to Python distribution utilities allowing conveni...7.8 0.0263 None reported
High CVE-2022-48560 Python 3.6 and 4 others: A use-after-free exists in Python through 3.9 via heappushpop in heapq.7.8 0.0204 None reported
High CVE-2023-43804 python-urllib3: urllib3 is a user-friendly HTTP client library for Python8.1 0.0136 None reported
High CVE-2024-22195 python-Jinja2: This update for python-Jinja2 fixes the following issues: - Fixed HTML attribute injection when passing user input a...7.8 0.0089 None reported
Showing 1 to 5 of 5 1

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.