Astra Linux – vulnerability in pypy

An issue was found in Python versions up to 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module incorrectly parses email addresses containing multiple @ characters. An application utilizing the email module and performing certain checks on the From/To headers...

Astra Linux – vulnerability in python-git

GitPython versions prior to 3.1.59 fail to disable mergeincludes when parsing .gitmodules, enabling attackers to reveal local file contents by including arbitrary file paths via include directives. Attackers can craft a malicious .gitmodules file containing include directives referencing sensitiv...

Astra Linux – Vulnerability in python-git

GitPython versions before 3.1.54 contain a remote code execution vulnerability in the checkunsafeoptions guard, which can be bypassed by introducing Git options into single-character kwarg values. Attackers can provide crafted option dictionaries to methods such as clonefrom, fetch, pull, push,...

Astra Linux – vulnerability in python-git

GitPython versions prior to 3.1.50 fail to validate newline characters in the section parameter of configwriter, enabling attackers to inject arbitrary section headers into .git/config. By inserting newlines, attackers can craft a forged core section with hooksPath pointing to directories under...

Astra Linux – Vulnerability in python-urllib3

urllib3 is a user-friendly HTTP client library for Python. urllib3 does not treat the Cookie HTTP header specially or provides any helpers for managing cookies over HTTP; that responsibility lies with the user. However, it is possible for a user to specify a Cookie header, and information may be...

Astra Linux – vulnerability in python-urllib3

urllib3 versions prior to 1.25.9 allow CRLF injection if the attacker controls the HTTP request method; this can be demonstrated by inserting CR and LF control characters into the first argument of putrequest. NOTE: this is similar to CVE-2020-26116...

Astra Linux – vulnerability in python3.11, python3.7

When folding a long comment into an email header containing only unfoldable characters, the parentheses would be lost. This can be exploited to inject headers into email messages where addresses are user-controlled and not sanitized...

Astra Linux - vulnerability in python-setuptools

PyPA setuptools versions prior to 65.5.1 allow remote attackers to cause a denial of service by using HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service ReDoS vulnerability in packageindex.py...

Astra Linux – Vulnerability in Mako

Mako is a template library written in Python. Prior to version 1.3.11, the TemplateLookup.gettemplate function was vulnerable to path traversal attacks when the URI started with // e.g., //../../../secret.txt. The root cause of this issue was an inconsistency between two implementations of path...

Astra Linux – Vulnerability in python-ldap

Python-ldap is a lightweight directory access protocol LDAP client API for Python. In versions prior to 3.4.5, the ldap.dn.escapednchars function incorrectly escaped \x00 by emitting a slash followed by a literal NUL byte instead of the RFC-4514 hex form \00. Any application that uses this functi...

Astra Linux – Vulnerability in Python-Django

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. MultiPartParser allows remote attackers to degrade performance by submitting multipart uploads with Content-Transfer-Encoding: base64, including excessive whitespace. Earlier, unsupported Django versions such a...

Astra Linux – Vulnerability in python-git

GitPython before version 3.1.58 fails to validate the names of submodules from the .gitmodules file. This allows attackers to create Git repositories at arbitrary filesystem paths outside of the intended clone directory. Attackers can create malicious repositories with traversal sequences in the...

Astra Linux – Vulnerability in python-ipaddress

The Lib/ipaddress.py module in Python up to version 3.8.3 incorrectly calculates hash values for the IPv4Interface and IPv6Interface classes. This may allow a remote attacker to cause a denial of service if an application relies on the performance of a dictionary containing IPv4Interface or...

Astra Linux – Vulnerability in Python 3.7, PHP 7.3

The Keccak XKCP SHA-3 reference implementation, prior to the update of fdc6fef, has an integer overflow and resulting buffer overflow issue. This vulnerability allows attackers to execute arbitrary code or compromise the expected cryptographic properties of the algorithm. This issue occurs within...

Astra Linux – Vulnerability in python-psutil

psutil also known as python-psutil from version 5.6.5 onwards may have a double-free issue. This issue occurs due to improper handling of reference counts within a while loop or for loop, which converts system data into a Python object...

Astra Linux – Vulnerability in python-git

GitPython before version 3.1.55 fails to disable environment variable expansion in Remote.create and Submodule.add URL handling, allowing attackers to exfiltrate secrets by providing URLs that contain variable references. Attackers can create URLs with environment variable tokens that are expande...

Astra Linux – Vulnerability in Pypy, Jython

The documentation XML-RPC server in Python, from versions 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4, has XSS vulnerabilities due to the servertitle field. This issue occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If the setservertitle function ...

Astra Linux – Vulnerability in pyasn1

pyasn1 is a generic ASN.1 library for Python. Prior to version 0.6.3, the pyasn1 library was vulnerable to a Denial of Service DoS attack caused by uncontrolled recursion during the decoding of ASN.1 data with deeply nested structures. An attacker could provide a crafted payload containing...

Astra Linux – vulnerability in Jinja2

Jinja is an extensible templating engine. Prior to version 3.1.5, there was a flaw in how the Jinja sandbox environment detected calls to str.format, allowing an attacker who controls the template’s contents to execute arbitrary Python code. To exploit this vulnerability, an attacker must have...

Astra Linux – vulnerability in python2.7, python3.7

An issue was found in comparedigest within Lib/hmac.py for Python up to version 3.9.1. Constant-time-defeating optimizations could be applied to the accumulator variable used in hmac.comparedigest...