425 matches found
Amazon Linux 2023 : python3.11, python3.11-devel, python3.11-idle (ALAS2023-2026-3231)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3231 advisory. When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion...
Unity Linux 20.1070a Security Update: python3.11 (UTSA-2026-141789)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-141789 advisory. An issue was found in the CPython tempfile.TemporaryDirectory class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The...
Unity Linux 20.1070a Security Update: python3.11 (UTSA-2026-141790)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-141790 advisory. Directory traversal vulnerability in the 1 extract and 2 extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite...
Unity Linux 20.1070a Security Update: python3.11 (UTSA-2026-141779)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-141779 advisory. An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers such as HTTP...
Unity Linux 20.1070a Security Update: python3.11 (UTSA-2026-141780)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-141780 advisory. The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified ...
Unity Linux 20.1070a Security Update: python3.11 (UTSA-2026-141778)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-141778 advisory. The ipaddress module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as globally reachable or private. This affected th...
Unity Linux 20.1070a Security Update: python3.11 (UTSA-2026-141783)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-141783 advisory. There is a HIGH severity vulnerability affecting the CPython zipfile module affecting zipfile.Path. Note that the more common API zipfile.ZipFile class is unaffected...
Rocky Linux 9.6 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792411096)
The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792411096 advisory. - The webbrowser.open API would accept leading dashes in the URL which could be handled as command line options for certain web...
AlmaLinux 9.6 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792411096)
The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792411096 advisory. - The webbrowser.open API would accept leading dashes in the URL which could be handled as command line options for certain web...
CLSA-2026-1791921187 python3.11: Fix of 2 CVEs
CVE-2026-6879: xml.etree.ElementPath: avoid quadratic behaviour in XPath index predicates 1, last, last-N - CVE-2026-18503: fix quadratic time in csv.Sniffer for quoted fields - Backport upstream 3.11 fixes the CVE-2026-18503 fix relies on or completes: correct matching of possessive quantifiers...
AlmaLinux 9.2 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1791921187)
The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791921187 advisory. - Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant C...
[SECURITY] Fedora 44 Update: python3.11-3.11.17-1.fc44
Python 3.11 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.11 package provides the "python3.11" executable:...
Fedora 44 : python3.11 (2026-f105922543)
The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-f105922543 advisory. New version of the Python interpreter Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has...
Fedora 43 : python3.11 (2026-37c784fc16)
The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-37c784fc16 advisory. New version of the Python interpreter Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has...
Important: python3.11-pip
Issue Overview: urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.readchunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigge...
Amazon Linux 2023 : python3.11-pip, python3.11-pip-wheel (ALAS2023-2026-3174)
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3174 advisory. urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.readchunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser...
CLSA-2026-1791572599 python3.11: Fix of 2 CVEs
CVE-2026-19445: prevent a use-after-free in server-side SSLContext SNI callbacks - CVE-2026-19553: validate SSLContext.wrapbio hostname and server-side parameters...
CLSA-2026-1791530000 python3.11: Fix of 2 CVEs
CVE-2026-19445: ssl: resolve the SSLContext for the SNI servername callback from the connection instead of the borrowed SSLCTX argument, and unregister the callback in contextdealloc, so a context dropped after snicallback switched the connection is no longer used after it is freed -...