70042 matches found
Astra Linux – Vulnerability in python-babel
In Babel.Locale before version 2.9.1, attackers could load arbitrary locale .dat files containing serialized Python objects through directory traversal, resulting in code execution...
Astra Linux – Vulnerability in Python 3.11
It allows the extraction filter to be ignored, enabling symlink targets to point outside the destination directory, and modifying some file metadata. This vulnerability affects users who use the TarFile module to extract untrusted tar archives using TarFile.extractall or TarFile.extract, with the...
Astra Linux – Vulnerability in Python 3.7, Python 2.7
A issue was discovered in Python before version 3.11.1. An unnecessary quadratic algorithm exists in one path when processing certain inputs to the IDNA RFC 3490 decoder. This could lead to a CPU denial of service if a maliciously crafted, unreasonably long hostname was provided to the decoder...
Astra Linux – Vulnerability in Python-Django
A issue was discovered in Django 5.0, prior to versions 5.0.7 and 4.2, prior to version 4.2.14. The derived classes of the django.core.files.storage.Storage base class, when they override generatefilename without replicating the file-path validations from the parent class, may allow directory...
Astra Linux – Vulnerability in ujson
UltraJSON is a fast JSON encoder and decoder written in pure C, with bindings for Python 3.7+. Before version 5.12.1, when the ujsondump function wrote to a file-like object, and the write operation raised an exception, the serialized JSON string object was not decremented, resulting in memory...
Astra Linux – Vulnerability found in Python 3.11, Python 3.7, and Pypy
The mitigation of CVE-2026-4519 was incomplete. If the URL contained “%action”, the mitigation could be bypassed by certain browser types. In this case, the “webbrowser.open” API could allow commands to be injected into the underlying shell. See CVE-2026-4519 for details...
Astra Linux – Vulnerability in Python 3.11, Python 3.7
The fix for CVE-2026-0672, which prevented control characters from being accepted in http.cookies.Morsel, was incomplete. The Morsel.update, |= operators, and methods for unpickingling data were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js.outpu...
Astra Linux – Vulnerability in Python 2.7, Python 3.7
A flaw was discovered in Python, specifically in the FTP File Transfer Protocol client library when operating in PASV passive mode. The issue arises from how the FTP client defaults to trusting the host based on the PASV response. This flaw allows an attacker to create a malicious FTP server that...
Astra Linux – Vulnerability in pypdf2
pypdf is a pure-Python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who exploits this vulnerability can create a PDF that results in unexpected long execution times. This quadratic execution time blocks the current process and can even...
Astra Linux – Vulnerability in python-bleach
A mutation XSS affects users who call bleachclean with any of the following tags: svg or math within the allowed tags p or br in allowed tags, style, title, noscript, script, textarea, noframes, iframe, or xmp within allowed tags. The keyword argument is stripcomments=False. Note: None of the abo...
Astra Linux – Vulnerability in Python 3.11
When using TarFile.errorlevel = 0 and extracting with a filter, the documented behavior is that any filtered members would be skipped and not extracted. However, the actual behavior of TarFile.errorlevel = 0 in affected versions is that the member will still be extracted and not skipped...
Astra Linux – Vulnerability in Python 3.7, Python 2.7
There is a flaw in the urllib’s AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server to which an HTTP client such as a web browser connects can trigger a Regular Expression Denial of Service ReDOS during an authentication request. This occurs when the server sends a...
Astra Linux – Vulnerability in python-urllib3
In urllib3 before version 1.24.2, the authorization HTTP header is not removed when following a cross-origin redirect i.e., a redirect that differs in host, port, or scheme. This can allow credentials in the authorization header to be exposed to unintended hosts or transmitted in cleartext. NOTE:...
Astra Linux – Vulnerability in Pypy
Python versions 2.7.x through 2.7.16, and 3.x through 3.7.2 are affected by improper handling of Unicode encoding with an incorrect netloc during NFKC normalization. The impact is information disclosure—credentials, cookies, etc., that are cached against a given hostname. The affected components...
Astra Linux – Vulnerability in Python 3.7
The lib/zipfile.py module in Python, as of version 3.7.2, allows remote attackers to cause a denial of service resource consumption through a ZIP bomb attack...
Astra Linux – Vulnerability in python-py
A denial of service attack via regular expressions in the py.path.svnwc component of py also known as python-py in versions up to 1.9.0 could be exploited by attackers to trigger a compute-time denial of service attack by providing malicious input to the blame functionality...
Astra Linux – Vulnerability in Python 3.7, Python 2.7
A flaw was discovered in Python. Improper handling of HTTP responses in the Python HTTP client code may allow a remote attacker, who controls the HTTP server, to cause the client script to enter an infinite loop, consuming CPU resources. The greatest threat of this vulnerability is to system...
ROOT-APP-PYPI-GHSA-93GM-QMQ6-W238 GHSA-93gm-qmq6-w238 in starlette - Patched by Root
Root has patched GHSA-93gm-qmq6-w238 in the starlette package for Root:PyPI. Multiple fixed versions available...
CVE-2026-87910
A flaw was found in the Python tarfile module. When extracting an archive containing a link on systems that do not support links, the module falls back to extracting the linked member. During this fallback, a security filter designed to prevent the extraction of certain files is not properly...