Search CVE reports

1 – 10 of 47 results

Detailed view

Sort by:

CVE-2024-12254

Medium priority

Needs evaluation

Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not “pause” writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the “high-water mark”. Because...

11 affected packages

python2.7, python3.10, python3.11, python3.12, python3.13...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
python2.7	Not in release	Not affected	Not affected	Not affected
python3.10	Not in release	Not affected	Not in release	Not in release
python3.11	Not in release	Not affected	Not in release	Not in release
python3.12	Needs evaluation	Not in release	Not in release	Not in release
python3.13	Not in release	Not in release	Not in release	Not in release
python3.4	Not in release	Not in release	Not in release	Not in release
python3.5	Not in release	Not in release	Not in release	Not in release
python3.6	Not in release	Not in release	Not in release	Not affected
python3.7	Not in release	Not in release	Not in release	Not affected
python3.8	Not in release	Not in release	Not affected	Not affected
python3.9	Not in release	Not in release	Not affected	Not in release

CVE-2024-11168

Medium priority

Vulnerable

The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren’t IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is...

11 affected packages

python2.7, python3.10, python3.11, python3.12, python3.13...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
python2.7	Not in release	Vulnerable	Vulnerable	Vulnerable
python3.10	Not in release	Vulnerable	Not in release	—
python3.11	Not in release	Vulnerable	Not in release	—
python3.12	Not affected	Not in release	Not in release	—
python3.13	Not in release	Not in release	Not in release	—
python3.4	Not in release	Not in release	Not in release	—
python3.5	Not in release	Not in release	Not in release	—
python3.6	Not in release	Not in release	Not in release	Vulnerable
python3.7	Not in release	Not in release	Not in release	Vulnerable
python3.8	Not in release	Not in release	Vulnerable	Needs evaluation
python3.9	Not in release	Not in release	Vulnerable	—

CVE-2024-9287

Medium priority

Some fixes available 4 of 13

A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual...

11 affected packages

python2.7, python3.10, python3.11, python3.12, python3.13...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
python2.7	Not in release	Not affected	Not affected	Not affected
python3.10	Not in release	Fixed	Not in release	—
python3.11	Not in release	Needs evaluation	Not in release	—
python3.12	Fixed	Not in release	Not in release	—
python3.13	Not in release	Not in release	Not in release	—
python3.4	Not in release	Not in release	Not in release	—
python3.5	Not in release	Not in release	Not in release	—
python3.6	Not in release	Not in release	Not in release	Needs evaluation
python3.7	Not in release	Not in release	Not in release	Needs evaluation
python3.8	Not in release	Not in release	Fixed	Needs evaluation
python3.9	Not in release	Not in release	Needs evaluation	—

CVE-2024-6232

Medium priority

Some fixes available 9 of 15

There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.

11 affected packages

python2.7, python3.10, python3.11, python3.12, python3.13...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
python2.7	Not in release	Fixed	Fixed	Not affected
python3.10	Not in release	Fixed	Not in release	Not in release
python3.11	Not in release	Needs evaluation	Not in release	Not in release
python3.12	Fixed	Not in release	Not in release	Not in release
python3.13	Not in release	Not in release	Not in release	Not in release
python3.4	Not in release	Not in release	Not in release	Not in release
python3.5	Not in release	Not in release	Not in release	Not in release
python3.6	Not in release	Not in release	Not in release	Needs evaluation
python3.7	Not in release	Not in release	Not in release	Needs evaluation
python3.8	Not in release	Not in release	Fixed	Needs evaluation
python3.9	Not in release	Not in release	Needs evaluation	Not in release

CVE-2024-8088

Medium priority

Some fixes available 3 of 11

There is a HIGH severity vulnerability affecting the CPython “zipfile” module affecting “zipfile.Path”. Note that the more common API “zipfile.ZipFile” class is unaffected. When iterating over names of entries in a zip archive...

11 affected packages

python2.7, python3.10, python3.11, python3.12, python3.13...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
python2.7	Not in release	Not affected	Not affected	Not affected
python3.10	Not in release	Fixed	Not in release	—
python3.11	Not in release	Needs evaluation	Not in release	—
python3.12	Fixed	Not in release	Not in release	—
python3.13	Not in release	Not in release	Not in release	—
python3.4	Not in release	Not in release	Not in release	—
python3.5	Not in release	Not in release	Not in release	—
python3.6	Not in release	Not in release	Not in release	Needs evaluation
python3.7	Not in release	Not in release	Not in release	Needs evaluation
python3.8	Not in release	Not in release	Fixed	Needs evaluation
python3.9	Not in release	Not in release	Needs evaluation	—

CVE-2024-7592

Low priority

Some fixes available 10 of 16

There is a LOW severity vulnerability affecting CPython, specifically the ‘http.cookies’ standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an...

11 affected packages

python2.7, python3.10, python3.11, python3.12, python3.13...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
python2.7	Not in release	Fixed	Fixed	Fixed
python3.10	Not in release	Fixed	Not in release	—
python3.11	Not in release	Needs evaluation	Not in release	—
python3.12	Fixed	Not in release	Not in release	—
python3.13	Not in release	Not in release	Not in release	—
python3.4	Not in release	Not in release	Not in release	—
python3.5	Not in release	Not in release	Not in release	—
python3.6	Not in release	Not in release	Not in release	Needs evaluation
python3.7	Not in release	Not in release	Not in release	Needs evaluation
python3.8	Not in release	Not in release	Fixed	Needs evaluation
python3.9	Not in release	Not in release	Needs evaluation	—

CVE-2024-6923

Medium priority

Some fixes available 8 of 16

There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized.

11 affected packages

python2.7, python3.10, python3.11, python3.12, python3.13...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
python2.7	Not in release	Fixed	Fixed	Fixed
python3.10	Not in release	Fixed	Not in release	Not in release
python3.11	Not in release	Needs evaluation	Not in release	Not in release
python3.12	Fixed	Not in release	Not in release	Not in release
python3.13	Not in release	Not in release	Not in release	Not in release
python3.4	Not in release	Not in release	Not in release	Not in release
python3.5	Not in release	Not in release	Not in release	Not in release
python3.6	Not in release	Not in release	Not in release	Needs evaluation
python3.7	Not in release	Not in release	Not in release	Needs evaluation
python3.8	Not in release	Not in release	Fixed	Needs evaluation
python3.9	Not in release	Not in release	Needs evaluation	Not in release

CVE-2024-3219

Medium priority

Not affected

The “socket” module provides a pure-Python fallback to the socket.socketpair() function for platforms that don’t support AF_UNIX, such as Windows. This pure-Python implementation uses AF_INET or AF_INET6 to create a local...

10 affected packages

python2.7, python3.10, python3.11, python3.12, python3.4...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
python2.7	Not in release	Not affected	Not affected	Not affected
python3.10	Not in release	Not affected	Not in release	—
python3.11	Not in release	Not affected	Not in release	—
python3.12	Not affected	Not in release	Not in release	—
python3.4	Not in release	Not in release	Not in release	—
python3.5	Not in release	Not in release	Not in release	—
python3.6	Not in release	Not in release	Not in release	Not affected
python3.7	Not in release	Not in release	Not in release	Not affected
python3.8	Not in release	Not in release	Not affected	Not affected
python3.9	Not in release	Not in release	Not affected	—

CVE-2024-5642

Low priority

Needs evaluation

CPython 3.9 and earlier doesn’t disallow configuring an empty list (”[]”) for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see...

10 affected packages

python2.7, python3.10, python3.11, python3.12, python3.4...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
python2.7	Not in release	Needs evaluation	Needs evaluation	Needs evaluation
python3.10	Not in release	Not affected	Not in release	—
python3.11	Not in release	Not affected	Not in release	—
python3.12	Not affected	Not in release	Not in release	—
python3.4	Not in release	Not in release	Not in release	—
python3.5	Not in release	Not in release	Not in release	—
python3.6	Not in release	Not in release	Not in release	Needs evaluation
python3.7	Not in release	Not in release	Not in release	Needs evaluation
python3.8	Not in release	Not in release	Not affected	Not affected
python3.9	Not in release	Not in release	Needs evaluation	—

CVE-2024-0397

Medium priority

Some fixes available 2 of 17

A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at...

10 affected packages

python2.7, python3.10, python3.11, python3.12, python3.4...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
python2.7	Not in release	Needs evaluation	Needs evaluation	Needs evaluation
python3.10	Not in release	Fixed	Not in release	—
python3.11	Not in release	Needs evaluation	Not in release	—
python3.12	Not affected	Not in release	Not in release	—
python3.4	Not in release	Not in release	Not in release	—
python3.5	Not in release	Not in release	Not in release	—
python3.6	Not in release	Not in release	Not in release	Needs evaluation
python3.7	Not in release	Not in release	Not in release	Needs evaluation
python3.8	Not in release	Not in release	Fixed	Needs evaluation
python3.9	Not in release	Not in release	Needs evaluation	—

Export to JSON

Results by page: