CVE-2025-4330

CVE-2025-4330 affects Python tarfile extraction: when using TarFile.extractall() or TarFile.extract() with filter=“data” or “tar”, the extraction filter can be bypassed, allowing symlink targets and some file metadata to be manipulated outside the destination directory. Affected Python versions a...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the tarfile module's extraction process when using the extractall or extract functions with the filter parameter set to "data" or "tar". An attacker can cause files or symlinks to be created outside the intended...

CVE-2025-4517 Arbitrary writes via tarfile realpath overflow

Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data". You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall or TarFile.extract using the filter= parameter with a value of...

OPENSUSE-SU-2025:15192-1 python39-3.9.22-3.1 on GA media

These are all security issues fixed in the python39-3.9.22-3.1 package on the GA media of openSUSE Tumbleweed...

PT-2025-23611

Name of the Vulnerable Software and Affected Versions Python versions 3.12 through 3.13 Description An issue in the tarfile module allows arbitrary filesystem writes outside the extraction directory when extracting untrusted tar archives. This occurs when using the TarFile.extractall or...

Fedora: Security Advisory (FEDORA-2025-e4c104502d)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

python3.12-semantic_version bug fix and enhancement update

An update is available for python3.12-semanticversion. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see t...

python3.12-Cython bug fix and enhancement update

An update is available for python3.12-Cython. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

Slackware Linux 15.0 python3 Vulnerability (SSA:2025-099-01)

The version of python3 installed on the remote host is prior to 3.9.22. It is, therefore, affected by a vulnerability as referenced in the SSA:2025-099-01 advisory. New python3 packages are available for Slackware 15.0 to fix security issues. Tenable has extracted the preceding description block...

RHSA-2025:3631 Red Hat Security Advisory: python3.12 security update

Bulletin has no description...

Amazon Linux 2 : python3 (ALAS-2025-2817)

The version of python3 installed on the remote host is prior to 3.7.16-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2817 advisory. A vulnerability has been found in the CPython venv module and CLI where path names provided when creating a virtual environment we...

Security Bulletin: Vulnerable Version Of Software In Use for watsonx Code Assistant On Prem product

Summary Watsonx Code Assistant On Prem product uses version of Python which has a known vulnerability Vulnerability Details CVEID:CVE-2024-0450 DESCRIPTION: Python CPython is vulnerable to a denial of service, caused by improper input validation by the zipfile module. By persuading a victim to op...

Amazon Linux 2023 : python3.12, python3.12-devel, python3.12-idle (ALAS2023-2025-899)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-899 advisory. The Python standard library functions urllib.parse.urlsplit and urlparse accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be...

Linux Distros Unpatched Vulnerability : CVE-2023-40587

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pyramid is an open source Python web framework. A path traversal vulnerability in Pyramid versions 2.0.0 and 2.0.1 impacts users of Python 3.11 that are using a...

Linux Distros Unpatched Vulnerability : CVE-2023-27043

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is...

AZL-57675 CVE-2025-1795 affecting package python3 for versions less than 3.9.19-13

During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded then the separator itself is also unicode-encoded. Expected behavior is that the separating comma remains a plan comma. This can result in the address header being misinterpreted...

BIT-PYTHON-MIN-2024-12254 Unbounded memory buffering in SelectorSocketTransport.writelines()

Starting in Python 3.12.0, the asyncio.SelectorSocketTransport.writelines method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the write buffer...

SUSE-SU-2025:20034-1 Security update for python-requests

This update for python-requests fixes the following issues: - Update to 2.32.2 To provide a more stable migration for custom HTTPAdapters impacted by the CVE changes in 2.32.0, we've renamed getconnection to a new public API, getconnectionwithtlscontext. Existing custom HTTPAdapters will need to...

Important: python3.12

Issue Overview: Starting in Python 3.12.0, the asyncio.SelectorSocketTransport.writelines method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the...

Access of Resource Using Incompatible Type ('Type Confusion')

Overview Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type 'Type Confusion' due to a type confusion bug in the CPython interpreter. An attacker can bypass security restrictions by exploiting the try/except clauses. This is only exploitable if the...