ALAS2023-2025-1343

References: CVE-2025-12084  CVE-2025-13836  CVE-2025-13837 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents. (CVE-2025-12084)

When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS. (CVE-2025-13836)

When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues (CVE-2025-13837)

Issue Correction:
Run dnf update python3.13 --releasever 2023.10.20260105 or dnf update --advisory ALAS2023-2025-1343 --releasever 2023.10.20260105 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    python3.13-devel-3.13.11-1.amzn2023.0.1.aarch64
    python3.13-tkinter-3.13.11-1.amzn2023.0.1.aarch64
    python3.13-idle-3.13.11-1.amzn2023.0.1.aarch64
    python3.13-3.13.11-1.amzn2023.0.1.aarch64
    python3.13-debugsource-3.13.11-1.amzn2023.0.1.aarch64
    python3.13-debug-3.13.11-1.amzn2023.0.1.aarch64
    python3.13-freethreading-debug-3.13.11-1.amzn2023.0.1.aarch64
    python3.13-libs-3.13.11-1.amzn2023.0.1.aarch64
    python3.13-debuginfo-3.13.11-1.amzn2023.0.1.aarch64
    python3.13-test-3.13.11-1.amzn2023.0.1.aarch64
    python3.13-freethreading-3.13.11-1.amzn2023.0.1.aarch64

src:
    python3.13-3.13.11-1.amzn2023.0.1.src

x86_64:
    python3.13-idle-3.13.11-1.amzn2023.0.1.x86_64
    python3.13-devel-3.13.11-1.amzn2023.0.1.x86_64
    python3.13-tkinter-3.13.11-1.amzn2023.0.1.x86_64
    python3.13-3.13.11-1.amzn2023.0.1.x86_64
    python3.13-debugsource-3.13.11-1.amzn2023.0.1.x86_64
    python3.13-freethreading-debug-3.13.11-1.amzn2023.0.1.x86_64
    python3.13-debug-3.13.11-1.amzn2023.0.1.x86_64
    python3.13-debuginfo-3.13.11-1.amzn2023.0.1.x86_64
    python3.13-libs-3.13.11-1.amzn2023.0.1.x86_64
    python3.13-test-3.13.11-1.amzn2023.0.1.x86_64
    python3.13-freethreading-3.13.11-1.amzn2023.0.1.x86_64