Search CVE reports

21 – 30 of 83 results

Detailed view

Sort by:

CVE-2024-11168

Medium priority

Fixed

The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren’t IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is...

11 affected packages

python2.7, python3.4, python3.5, python3.6, python3.7...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
python2.7	Not in release	Fixed	Fixed	Fixed
python3.4	Not in release	Not in release	Not in release	—
python3.5	Not in release	Not in release	Not in release	—
python3.6	Not in release	Not in release	Not in release	Fixed
python3.7	Not in release	Not in release	Not in release	Fixed
python3.8	Not in release	Not in release	Fixed	Fixed
python3.9	Not in release	Not in release	Fixed	—
python3.10	Not in release	Fixed	Not in release	—
python3.11	Not in release	Fixed	Not in release	—
python3.12	Not affected	Not in release	Not in release	—
python3.13	Not in release	Not in release	Not in release	—

CVE-2024-0450

Medium priority

Some fixes available 13 of 17

An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The zipfile module is vulnerable to “quoted-overlap” zip-bombs which exploit the zip format to create a...

10 affected packages

python2.7, python3.4, python3.5, python3.6, python3.7...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
python2.7	Not in release	Fixed	Fixed	Needs evaluation
python3.4	Not in release	Not in release	Not in release	—
python3.5	Not in release	Not in release	Not in release	—
python3.6	Not in release	Not in release	Not in release	Fixed
python3.7	Not in release	Not in release	Not in release	Fixed
python3.8	Not in release	Not in release	Fixed	Fixed
python3.9	Not in release	Not in release	Fixed	—
python3.10	Not in release	Fixed	Not in release	—
python3.11	Not in release	Fixed	Not in release	—
python3.12	Not affected	Not in release	Not in release	—

CVE-2024-0397

Medium priority

Some fixes available 2 of 15

A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at...

10 affected packages

python2.7, python3.4, python3.5, python3.6, python3.7...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
python2.7	Not in release	Needs evaluation	Needs evaluation	Needs evaluation
python3.4	Not in release	Not in release	Not in release	—
python3.5	Not in release	Not in release	Not in release	—
python3.6	Not in release	Not in release	Not in release	Needs evaluation
python3.7	Not in release	Not in release	Not in release	Needs evaluation
python3.8	Not in release	Not in release	Fixed	Needs evaluation
python3.9	Not in release	Not in release	Needs evaluation	—
python3.10	Not in release	Fixed	Not in release	—
python3.11	Not in release	Needs evaluation	Not in release	—
python3.12	Not affected	Not in release	Not in release	—

CVE-2023-6597

Medium priority

Some fixes available 9 of 10

An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference symlinks during cleanup of...

10 affected packages

python2.7, python3.4, python3.5, python3.6, python3.7...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
python2.7	Not in release	Not affected	Not affected	Not affected
python3.4	Not in release	Not in release	Not in release	—
python3.5	Not in release	Not in release	Not in release	—
python3.6	Not in release	Not in release	Not in release	Not affected
python3.7	Not in release	Not in release	Not in release	Fixed
python3.8	Not in release	Not in release	Fixed	Fixed
python3.9	Not in release	Not in release	Fixed	—
python3.10	Not in release	Fixed	Not in release	—
python3.11	Not in release	Fixed	Not in release	—
python3.12	Not affected	Not in release	Not in release	—

CVE-2023-6507

Medium priority

Fixed

An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases. When using the `extra_groups=` parameter with an empty list as a value...

6 affected packages

python2.7, python3.10, python3.11, python3.12, python3.7, python3.9

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
python2.7	Not in release	Not affected	Not affected	Not affected
python3.10	Not in release	Not affected	Not in release	Ignored
python3.11	Not in release	Not affected	Not in release	Ignored
python3.12	Not affected	Not in release	Not in release	Ignored
python3.7	Not in release	Not in release	Not in release	Not affected
python3.9	Not in release	Not in release	Not affected	Ignored

CVE-2023-41105

Medium priority

Fixed

An issue was discovered in Python 3.11 through 3.11.4. If a path containing ‘\0’ bytes is passed to os.path.normpath(), the path will be truncated unexpectedly at the first ‘\0’ byte. There are plausible cases in which...

11 affected packages

python, python2.7, python3.4, python3.5, python3.6...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
python	Not in release	Not in release	Not in release	Ignored
python2.7	Not in release	Not affected	Not affected	Not affected
python3.4	Not in release	Not in release	Not in release	Not in release
python3.5	Not in release	Not in release	Not in release	Not in release
python3.6	Not in release	Not in release	Not in release	Not affected
python3.7	Not in release	Not in release	Not in release	Not affected
python3.8	Not in release	Not in release	Not affected	Not affected
python3.9	Not in release	Not in release	Not affected	Not in release
python3.10	Not in release	Not affected	Not in release	Not in release
python3.11	Not in release	Fixed	Not in release	Not in release
python3.12	Not affected	Not in release	Not in release	Not in release

CVE-2023-40217

Medium priority

Some fixes available 15 of 16

An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If a TLS server-side...

10 affected packages

python2.7, python3.10, python3.11, python3.12, python3.7...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
python2.7	Not in release	Fixed	Fixed	Fixed
python3.10	Not in release	Fixed	Not in release	Ignored
python3.11	Not in release	Fixed	Not in release	Ignored
python3.12	Not affected	Not in release	Not in release	Ignored
python3.7	Not in release	Not in release	Not in release	Fixed
python3.9	Not in release	Not in release	Fixed	Ignored
python3.4	Not in release	Not in release	Not in release	Not in release
python3.5	Not in release	Not in release	Not in release	Not in release
python3.6	Not in release	Not in release	Not in release	Fixed
python3.8	Not in release	Not in release	Fixed	Fixed

CVE-2023-38898

Medium priority

Not affected

** DISPUTED ** An issue in Python cpython v.3.7 allows an attacker to obtain sensitive information via the _asyncio._swap_current_task component. NOTE: this is disputed by the vendor because (1) neither 3.7 nor any other release...

11 affected packages

python, python2.7, python3.4, python3.5, python3.6...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
python	Not in release	Not in release	Not in release	Ignored
python2.7	Not in release	Not affected	Not affected	Not affected
python3.4	Not in release	Not in release	Not in release	Not in release
python3.5	Not in release	Not in release	Not in release	Not in release
python3.6	Not in release	Not in release	Not in release	Not affected
python3.7	Not in release	Not in release	Not in release	Not affected
python3.8	Not in release	Not in release	Not affected	Not affected
python3.9	Not in release	Not in release	Not affected	Not in release
python3.10	Not in release	Not affected	Not in release	Not in release
python3.11	Not in release	Not affected	Not in release	Not in release
python3.12	Not affected	Not in release	Not in release	Not in release

CVE-2023-36632

Medium priority

Not affected

** DISPUTED ** The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger “RecursionError: maximum recursion depth exceeded while calling a Python object” via a crafted argument. This argument...

11 affected packages

python, python2.7, python3.4, python3.5, python3.6...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
python	—	Not in release	Not in release	Ignored
python2.7	—	Not affected	Not affected	Not affected
python3.4	—	Not in release	Not in release	Not in release
python3.5	—	Not in release	Not in release	Not in release
python3.6	—	Not in release	Not in release	Not affected
python3.7	—	Not in release	Not in release	Not affected
python3.8	—	Not in release	Not affected	Not affected
python3.9	—	Not in release	Not affected	Not in release
python3.10	—	Not affected	Not in release	Not in release
python3.11	—	Not affected	Not in release	Not in release
python3.12	—	Not in release	Not in release	Not in release

CVE-2023-33595

Medium priority

Not affected

CPython v3.12.0 alpha 7 was discovered to contain a heap use-after-free via the function ascii_decode at /Objects/unicodeobject.c.

11 affected packages

python, python2.7, python3.11, python3.12, python3.4...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
python	—	Not in release	Not in release	Ignored
python2.7	—	Not affected	Not affected	Not affected
python3.11	—	Not affected	Not in release	Not in release
python3.12	—	Not in release	Not in release	Not in release
python3.4	—	Not in release	Not in release	Not in release
python3.5	—	Not in release	Not in release	Not in release
python3.6	—	Not in release	Not in release	Not affected
python3.7	—	Not in release	Not in release	Not affected
python3.8	—	Not in release	Not affected	Not affected
python3.9	—	Not in release	Not affected	Not in release
python3.10	—	Not affected	Not in release	Not in release

Export to JSON

Results by page: