Search CVE reports
61 – 70 of 83 results
Some fixes available 10 of 16
Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb.
6 affected packages
python2.7, python3.4, python3.5, python3.6, python3.7, python3.8
Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
---|---|---|---|---|
python2.7 | Not in release | Fixed | Fixed | Fixed |
python3.4 | Not in release | Not in release | Not in release | Not in release |
python3.5 | Not in release | Not in release | Not in release | Not in release |
python3.6 | Not in release | Not in release | Not in release | Fixed |
python3.7 | Not in release | Not in release | Not in release | Fixed |
python3.8 | Not in release | Not in release | Not affected | Not affected |
Some fixes available 8 of 9
Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that...
5 affected packages
python2.7, python3.4, python3.5, python3.6, python3.7
Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
---|---|---|---|---|
python2.7 | Not in release | Not affected | Not affected | Fixed |
python3.4 | Not in release | Not in release | Not in release | Not in release |
python3.5 | Not in release | Not in release | Not in release | Not in release |
python3.6 | Not in release | Not in release | Not in release | Fixed |
python3.7 | Not in release | Not in release | Not in release | Not affected |
Some fixes available 7 of 8
An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service....
5 affected packages
python2.7, python3.4, python3.5, python3.6, python3.7
Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
---|---|---|---|---|
python2.7 | Not in release | Not affected | Not affected | Fixed |
python3.4 | Not in release | Not in release | Not in release | Not in release |
python3.5 | Not in release | Not in release | Not in release | Not in release |
python3.6 | Not in release | Not in release | Not in release | Fixed |
python3.7 | Not in release | Not in release | Not in release | Not affected |
Some fixes available 11 of 17
In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.
6 affected packages
python2.7, python3.4, python3.5, python3.6, python3.7, python3.8
Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
---|---|---|---|---|
python2.7 | Not in release | Not affected | Fixed | Fixed |
python3.4 | Not in release | Not in release | Not in release | Not in release |
python3.5 | Not in release | Not in release | Not in release | Not in release |
python3.6 | Not in release | Not in release | Not in release | Fixed |
python3.7 | Not in release | Not in release | Not in release | Fixed |
python3.8 | Not in release | Not in release | Fixed | Fixed |
Some fixes available 12 of 17
An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument...
6 affected packages
python2.7, python3.4, python3.5, python3.6, python3.7, python3.8
Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
---|---|---|---|---|
python2.7 | Not in release | Not affected | Not affected | Fixed |
python3.4 | Not in release | Not in release | Not in release | Not in release |
python3.5 | Not in release | Not in release | Not in release | Not in release |
python3.6 | Not in release | Not in release | Not in release | Fixed |
python3.7 | Not in release | Not in release | Not in release | Fixed |
python3.8 | Not in release | Not in release | Fixed | Fixed |
Some fixes available 11 of 22
library/glob.html in the Python 2 and 3 documentation before 2016 has potentially misleading information about whether sorting occurs, as demonstrated by irreproducible cancer-research results. NOTE: the effects of this...
6 affected packages
python2.7, python3.5, python3.6, python3.4, python3.7, python3.8
Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
---|---|---|---|---|
python2.7 | Not in release | Vulnerable | Fixed | Fixed |
python3.5 | Not in release | Not in release | Not in release | Not in release |
python3.6 | Not in release | Not in release | Not in release | Fixed |
python3.4 | Not in release | Not in release | Not in release | Not in release |
python3.7 | Not in release | Not in release | Not in release | Fixed |
python3.8 | Not in release | Not in release | Fixed | Fixed |
Some fixes available 9 of 10
The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python...
6 affected packages
python2.7, python3.4, python3.5, python3.6, python3.7, python3.8
Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
---|---|---|---|---|
python2.7 | Not in release | Not affected | Not affected | Fixed |
python3.4 | Not in release | Not in release | Not in release | Not in release |
python3.5 | Not in release | Not in release | Not in release | Not in release |
python3.6 | Not in release | Not in release | Not in release | Fixed |
python3.7 | Not in release | Not in release | Not in release | Not affected |
python3.8 | Not in release | Not in release | Not affected | Not affected |
An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the...
5 affected packages
python2.7, python3.4, python3.5, python3.6, python3.7
Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
---|---|---|---|---|
python2.7 | Not in release | Not affected | Not affected | Fixed |
python3.4 | Not in release | Not in release | Not in release | Not in release |
python3.5 | Not in release | Not in release | Not in release | Not in release |
python3.6 | Not in release | Not in release | Not in release | Fixed |
python3.7 | Not in release | Not in release | Not in release | Not affected |
Some fixes available 9 of 12
A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to...
5 affected packages
python2.7, python3.4, python3.5, python3.6, python3.7
Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
---|---|---|---|---|
python2.7 | Not in release | Not affected | Not affected | Fixed |
python3.4 | Not in release | Not in release | Not in release | Not in release |
python3.5 | Not in release | Not in release | Not in release | Not in release |
python3.6 | Not in release | Not in release | Not in release | Fixed |
python3.7 | Not in release | Not in release | Not in release | Not affected |
Some fixes available 8 of 10
http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this...
5 affected packages
python2.7, python3.4, python3.5, python3.6, python3.7
Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
---|---|---|---|---|
python2.7 | Not in release | Not affected | Not affected | Fixed |
python3.4 | Not in release | Not in release | Not in release | Not in release |
python3.5 | Not in release | Not in release | Not in release | Not in release |
python3.6 | Not in release | Not in release | Not in release | Fixed |
python3.7 | Not in release | Not in release | Not in release | Not affected |