Astra Linux – Vulnerability in python-cryptography

A flaw was discovered in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which could result in the exposure of confidential or sensitive data...

Astra Linux – vulnerability in python-git

GitPython versions prior to 3.1.59 fail to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives such as core.hooksPath. Attackers can craft config files containing embedded newlines; these become active git directives...

Astra Linux – vulnerability in python-git

GitPython versions prior to 3.1.50 fail to validate newline characters in the section parameter of configwriter, enabling attackers to inject arbitrary section headers into .git/config. By inserting newlines, attackers can craft a forged core section with hooksPath pointing to directories under...

Astra Linux – Vulnerability in Mako

Mako is a template library written in Python. Prior to version 1.3.11, the TemplateLookup.gettemplate function was vulnerable to path traversal attacks when the URI started with // e.g., //../../../secret.txt. The root cause of this issue was an inconsistency between two implementations of path...

Astra Linux – vulnerability in Jinja2

Jinja is an extensible templating engine. Prior to version 3.1.5, there was a flaw in how the Jinja sandbox environment detected calls to str.format, allowing an attacker who controls the template’s contents to execute arbitrary Python code. To exploit this vulnerability, an attacker must have...

Astra Linux – vulnerability in python3.11, python3.7

When loading a plist file, the plistlib module reads data at a size specified by the file itself; this means that a malicious file can cause OOM and DoS issues...

Astra Linux - vulnerability in pyyaml

PyYAML versions 5.1 through 5.1.2 suffer from insufficient restrictions on the load and loadall functions due to a class deserialization issue; for example, Popen is a class within the subprocess module. NOTE: This issue arises because a fix for CVE-2017-18342 is incomplete...

Astra Linux – vulnerability in python-urllib3

In the urllib3 library up to version 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter...

Astra Linux – Vulnerabilities in Python 2.7, Python 3.7, and Pypy

A XXE issue was discovered in Python through version 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to prevent XML vulnerabilities...

Astra Linux – vulnerability in python2.7, python3.7

An issue was found in comparedigest within Lib/hmac.py for Python up to version 3.9.1. Constant-time-defeating optimizations could be applied to the accumulator variable used in hmac.comparedigest...

Astra Linux – Vulnerability in Python 3.7

A flaw was discovered in Python. In algorithms with quadratic time complexity that use non-binary bases, when using int“text”, a system may take 50 milliseconds to parse an int string with 100,000 digits, and 5 seconds for strings with 1,000,000 digits. Functions like float, decimal, int.frombyte...

Astra Linux – vulnerability in python3.7, python2.7, pypy

An issue was found in Python versions prior to 3.8.18, 3.9.x prior to 3.9.18, 3.10.x prior to 3.10.13, and 3.11.x prior to 3.11.5. It primarily affects servers such as HTTP servers that employ TLS client authentication. When a TLS server-side socket is created, data is received into its buffer, a...

Astra Linux – vulnerability in python-git

GitPython versions prior to 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove and Head.checkout. Attackers can supply --pathspec-from-file and --pathspec-file-nul parameters to read arbitrary files accessible to the process, with full file contents...

Astra Linux – Vulnerability in libxml2

In libxml2 versions before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API Python bindings due to an incorrect return value. This issue occurs in the xmlPythonFileRead and xmlPythonFileReadRaw functions, caused by a discrepancy between bytes and characters...

Astra Linux – Vulnerability in python-psutil

psutil also known as python-psutil from version 5.6.5 onwards may have a double-free issue. This issue occurs due to improper handling of reference counts within a while loop or for loop, which converts system data into a Python object...

Astra Linux – Vulnerability in python-git

GitPython before version 3.1.58 fails to validate the names of submodules from the .gitmodules file. This allows attackers to create Git repositories at arbitrary filesystem paths outside of the intended clone directory. Attackers can create malicious repositories with traversal sequences in the...

Astra Linux – vulnerability in python-git

GitPython versions prior to 3.1.59 omit the --separate-git-dir option from unsafegitcloneoptions, allowing attackers to create arbitrary Git directories outside the intended clone destination. Attackers can pass the separategitdir parameter to Repo.clonefrom or Repo.clone to redirect repository...

Astra Linux – Vulnerability in python-ldap

Python-ldap is a lightweight directory access protocol LDAP client API for Python. In versions prior to 3.4.5, the ldap.dn.escapednchars function incorrectly escaped \x00 by emitting a slash followed by a literal NUL byte instead of the RFC-4514 hex form \00. Any application that uses this functi...

Astra Linux – vulnerability in python3.11, python3.7

When given a user-controlled command, the poplib module can inject additional commands via newline characters. Mitigation rejects commands containing control characters...

Astra Linux – vulnerability in python-django, python2.7

Packages python/cpython versions 0 through 3.6.13, 3.7.0 through 3.7.10, 3.8.0 through 3.8.8, and 3.9.0 through 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parseqsl and urllib.parse.parseqs. This vulnerability exploits a technique known as “parameter cloaking.” When an attacker i...