Search CVE reports


Toggle filters

21 – 30 of 52 results


CVE-2024-11168

Medium priority
Fixed

The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren’t IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is...

11 affected packages

python2.7, python3.4, python3.5, python3.6, python3.7...

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS
python2.7 Not in release Fixed Fixed Fixed
python3.4 Not in release Not in release Not in release
python3.5 Not in release Not in release Not in release
python3.6 Not in release Not in release Not in release Fixed
python3.7 Not in release Not in release Not in release Fixed
python3.8 Not in release Not in release Fixed Fixed
python3.9 Not in release Not in release Fixed
python3.10 Not in release Fixed Not in release
python3.11 Not in release Fixed Not in release
python3.12 Not affected Not in release Not in release
python3.13 Not in release Not in release Not in release
Show all 11 packages Show less packages

CVE-2024-0450

Medium priority

Some fixes available 13 of 17

An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The zipfile module is vulnerable to “quoted-overlap” zip-bombs which exploit the zip format to create a...

10 affected packages

python2.7, python3.4, python3.5, python3.6, python3.7...

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS
python2.7 Not in release Fixed Fixed Needs evaluation
python3.4 Not in release Not in release Not in release
python3.5 Not in release Not in release Not in release
python3.6 Not in release Not in release Not in release Fixed
python3.7 Not in release Not in release Not in release Fixed
python3.8 Not in release Not in release Fixed Fixed
python3.9 Not in release Not in release Fixed
python3.10 Not in release Fixed Not in release
python3.11 Not in release Fixed Not in release
python3.12 Not affected Not in release Not in release
Show all 10 packages Show less packages

CVE-2024-0397

Medium priority

Some fixes available 2 of 15

A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at...

10 affected packages

python2.7, python3.4, python3.5, python3.6, python3.7...

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS
python2.7 Not in release Needs evaluation Needs evaluation Needs evaluation
python3.4 Not in release Not in release Not in release
python3.5 Not in release Not in release Not in release
python3.6 Not in release Not in release Not in release Needs evaluation
python3.7 Not in release Not in release Not in release Needs evaluation
python3.8 Not in release Not in release Fixed Needs evaluation
python3.9 Not in release Not in release Needs evaluation
python3.10 Not in release Fixed Not in release
python3.11 Not in release Needs evaluation Not in release
python3.12 Not affected Not in release Not in release
Show all 10 packages Show less packages

CVE-2023-6597

Medium priority

Some fixes available 9 of 10

An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference symlinks during cleanup of...

10 affected packages

python2.7, python3.4, python3.5, python3.6, python3.7...

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS
python2.7 Not in release Not affected Not affected Not affected
python3.4 Not in release Not in release Not in release
python3.5 Not in release Not in release Not in release
python3.6 Not in release Not in release Not in release Not affected
python3.7 Not in release Not in release Not in release Fixed
python3.8 Not in release Not in release Fixed Fixed
python3.9 Not in release Not in release Fixed
python3.10 Not in release Fixed Not in release
python3.11 Not in release Fixed Not in release
python3.12 Not affected Not in release Not in release
Show all 10 packages Show less packages

CVE-2023-6507

Medium priority
Fixed

An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases. When using the `extra_groups=` parameter with an empty list as a value...

6 affected packages

python2.7, python3.10, python3.11, python3.12, python3.7, python3.9

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS
python2.7 Not in release Not affected Not affected Not affected
python3.10 Not in release Not affected Not in release Ignored
python3.11 Not in release Not affected Not in release Ignored
python3.12 Not affected Not in release Not in release Ignored
python3.7 Not in release Not in release Not in release Not affected
python3.9 Not in release Not in release Not affected Ignored
Show less packages

CVE-2023-41105

Medium priority
Fixed

An issue was discovered in Python 3.11 through 3.11.4. If a path containing ‘\0’ bytes is passed to os.path.normpath(), the path will be truncated unexpectedly at the first ‘\0’ byte. There are plausible cases in which...

11 affected packages

python, python2.7, python3.4, python3.5, python3.6...

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS
python Not in release Not in release Not in release Ignored
python2.7 Not in release Not affected Not affected Not affected
python3.4 Not in release Not in release Not in release Not in release
python3.5 Not in release Not in release Not in release Not in release
python3.6 Not in release Not in release Not in release Not affected
python3.7 Not in release Not in release Not in release Not affected
python3.8 Not in release Not in release Not affected Not affected
python3.9 Not in release Not in release Not affected Not in release
python3.10 Not in release Not affected Not in release Not in release
python3.11 Not in release Fixed Not in release Not in release
python3.12 Not affected Not in release Not in release Not in release
Show all 11 packages Show less packages

CVE-2023-40217

Medium priority

Some fixes available 15 of 16

An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If a TLS server-side...

10 affected packages

python2.7, python3.10, python3.11, python3.12, python3.7...

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS
python2.7 Not in release Fixed Fixed Fixed
python3.10 Not in release Fixed Not in release Ignored
python3.11 Not in release Fixed Not in release Ignored
python3.12 Not affected Not in release Not in release Ignored
python3.7 Not in release Not in release Not in release Fixed
python3.9 Not in release Not in release Fixed Ignored
python3.4 Not in release Not in release Not in release Not in release
python3.5 Not in release Not in release Not in release Not in release
python3.6 Not in release Not in release Not in release Fixed
python3.8 Not in release Not in release Fixed Fixed
Show all 10 packages Show less packages

CVE-2023-38898

Medium priority
Not affected

** DISPUTED ** An issue in Python cpython v.3.7 allows an attacker to obtain sensitive information via the _asyncio._swap_current_task component. NOTE: this is disputed by the vendor because (1) neither 3.7 nor any other release...

11 affected packages

python, python2.7, python3.4, python3.5, python3.6...

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS
python Not in release Not in release Not in release Ignored
python2.7 Not in release Not affected Not affected Not affected
python3.4 Not in release Not in release Not in release Not in release
python3.5 Not in release Not in release Not in release Not in release
python3.6 Not in release Not in release Not in release Not affected
python3.7 Not in release Not in release Not in release Not affected
python3.8 Not in release Not in release Not affected Not affected
python3.9 Not in release Not in release Not affected Not in release
python3.10 Not in release Not affected Not in release Not in release
python3.11 Not in release Not affected Not in release Not in release
python3.12 Not affected Not in release Not in release Not in release
Show all 11 packages Show less packages

CVE-2023-36632

Medium priority
Not affected

** DISPUTED ** The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger “RecursionError: maximum recursion depth exceeded while calling a Python object” via a crafted argument. This argument...

11 affected packages

python, python2.7, python3.4, python3.5, python3.6...

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS
python Not in release Not in release Ignored
python2.7 Not affected Not affected Not affected
python3.4 Not in release Not in release Not in release
python3.5 Not in release Not in release Not in release
python3.6 Not in release Not in release Not affected
python3.7 Not in release Not in release Not affected
python3.8 Not in release Not affected Not affected
python3.9 Not in release Not affected Not in release
python3.10 Not affected Not in release Not in release
python3.11 Not affected Not in release Not in release
python3.12 Not in release Not in release Not in release
Show all 11 packages Show less packages

CVE-2023-33595

Medium priority
Not affected

CPython v3.12.0 alpha 7 was discovered to contain a heap use-after-free via the function ascii_decode at /Objects/unicodeobject.c.

11 affected packages

python, python2.7, python3.11, python3.12, python3.4...

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS
python Not in release Not in release Ignored
python2.7 Not affected Not affected Not affected
python3.11 Not affected Not in release Not in release
python3.12 Not in release Not in release Not in release
python3.4 Not in release Not in release Not in release
python3.5 Not in release Not in release Not in release
python3.6 Not in release Not in release Not affected
python3.7 Not in release Not in release Not affected
python3.8 Not in release Not affected Not affected
python3.9 Not in release Not affected Not in release
python3.10 Not affected Not in release Not in release
Show all 11 packages Show less packages