72397 matches found
Astra Linux – Vulnerability in Python 3.7
A issue was discovered in the CPython tempfile.TemporaryDirectory class, affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, 3.8.18, and earlier versions. The tempfile.TemporaryDirectory class would dereference symlinks during cleanup of permissions-related errors. This means that users who can...
Astra Linux – Vulnerability in python-cryptography
Cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions, Cipher.updateinto would accept Python objects that implement the buffer protocol, but only provide immutable buffers. This would allow immutable objects such as bytes to b...
Astra Linux – Vulnerability in ujson
UltraJSON is a fast JSON encoder and decoder written in pure C, with bindings for Python 3.7+. Before version 5.12.1, when the ujsondump function wrote to a file-like object, and the write operation raised an exception, the serialized JSON string object was not decremented, resulting in memory...
Astra Linux – Vulnerability in python-urllib3
In urllib3 before version 1.24.2, the authorization HTTP header is not removed when following a cross-origin redirect i.e., a redirect that differs in host, port, or scheme. This can allow credentials in the authorization header to be exposed to unintended hosts or transmitted in cleartext. NOTE:...
Astra Linux – Vulnerability in Python 2.7
In Python 3.x through 3.9.1, there is a buffer overflow issue in the PyCArgrepr function within ctypes/callproc.c. This issue may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input. This was demonstrated by the use of the argument...
Astra Linux – Vulnerability in python-bleach
A mutation XSS affects users who call bleachclean with any of the following tags: svg or math within the allowed tags p or br in allowed tags, style, title, noscript, script, textarea, noframes, iframe, or xmp within allowed tags. The keyword argument is stripcomments=False. Note: None of the abo...
Astra Linux – Vulnerability in python-oslo.utils
A flaw was discovered in python-oslo-utils. Due to improper parsing, passwords that contain double quotes " cause incorrect masking in debug logs, resulting in any part of the password after the double quote being displayed as plain text...
Astra Linux – Vulnerability in Python-Django
A issue was discovered in Django 5.0, prior to versions 5.0.7 and 4.2, prior to version 4.2.14. The derived classes of the django.core.files.storage.Storage base class, when they override generatefilename without replicating the file-path validations from the parent class, may allow directory...
Astra Linux – Vulnerability in Pypy
Python versions 2.7.x through 2.7.16, and 3.x through 3.7.2 are affected by improper handling of Unicode encoding with an incorrect netloc during NFKC normalization. The impact is information disclosure—credentials, cookies, etc., that are cached against a given hostname. The affected components...
Astra Linux – Vulnerability found in Python 3.11, Python 3.7, and Pypy
The mitigation of CVE-2026-4519 was incomplete. If the URL contained “%action”, the mitigation could be bypassed by certain browser types. In this case, the “webbrowser.open” API could allow commands to be injected into the underlying shell. See CVE-2026-4519 for details...
Astra Linux – Vulnerability in Python 3.11
When using TarFile.errorlevel = 0 and extracting with a filter, the documented behavior is that any filtered members would be skipped and not extracted. However, the actual behavior of TarFile.errorlevel = 0 in affected versions is that the member will still be extracted and not skipped...
Astra Linux – Vulnerability in python-py
A denial of service attack via regular expressions in the py.path.svnwc component of py also known as python-py in versions up to 1.9.0 could be exploited by attackers to trigger a compute-time denial of service attack by providing malicious input to the blame functionality...
Astra Linux – Vulnerability in Python 3.7
The lib/zipfile.py module in Python, as of version 3.7.2, allows remote attackers to cause a denial of service resource consumption through a ZIP bomb attack...
ROOT-APP-PYPI-GHSA-93GM-QMQ6-W238 GHSA-93gm-qmq6-w238 in starlette - Patched by Root
Root has patched GHSA-93gm-qmq6-w238 in the starlette package for Root:PyPI. Multiple fixed versions available...
CVE-2026-87910
A flaw was found in the Python tarfile module. When extracting an archive containing a link on systems that do not support links, the module falls back to extracting the linked member. During this fallback, a security filter designed to prevent the extraction of certain files is not properly...
ROOT-APP-PYPI-CVE-2026-53539 CVE-2026-53539 in python-multipart - Patched by Root
Root has patched CVE-2026-53539 in the python-multipart package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-24486 CVE-2026-24486 in python-multipart - Patched by Root
Root has patched CVE-2026-24486 in the python-multipart package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2024-24762 CVE-2024-24762 in python-multipart - Patched by Root
Root has patched CVE-2024-24762 in the python-multipart package for Root:PyPI. Multiple fixed versions available...