USN-4428-1: Python vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Canonical Ubuntu 16.04 Canonical Ubuntu 18.04 Description It was discovered that Python documentation had a misleading information. A security issue could be possibly caused by wrong assumptions of this information...

ark -- extraction outside of extraction directory

Albert Astals Cid reports: Overview A maliciously crafted TAR archive containing symlink entries would install files anywhere in the user's home directory upon extraction. Proof of concept For testing, an example of malicious archive can be found at dirsymlink.tar Impact Users can unwillingly...

Debian DLA-2337-1 : python2.7 security update

Multiple vulnerabilities were discovered in Python2.7, an interactive high-level object-oriented language. CVE-2018-20852 By using a malicious server an attacker might steal cookies that are meant for other domains. CVE-2019-5010 NULL pointer dereference using a specially crafted X509 certificate...

Multiple directory traversal vulnerabilities in the (1) tar_extract_glob and (2) tar_extract_all functions in libtar 1.2.20 and earlier allow remote attackers to overwrite arbitrary files via a .. (dot dot) in a crafted tar file.

...

In Lib/tarfile.py in Python through 3.8.3 an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open because _proc_pax lacks header validation.

...

Debian: Security Advisory (DLA-2330-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 2330-1] jruby security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2330-1 [email protected] https://www.debian.org/lts/security/ August 16, 2020 https://wiki.debian.org/LTS - ------------------------------------------------------------------------- Package...

[SECURITY] Fedora 32 Update: ark-20.04.3-3.fc32

Ark is a program for managing various archive formats. Archives can be viewed, extracted, created and modified from within Ark. The program can handle various formats such as tar, gzip, bzip2, zip, rar and lha if appropriate command-line programs are installed...

Denial Of Service (DoS)

python3 is vulnerable to denial of service. An attacker is able to craft a TAR archive that results in an infinite loop when parsed in tarfile.open due to a lack of header validation in procpax...

Huawei EulerOS: Security Advisory for python2 (EulerOS-SA-2020-1822)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP8 : python3 (EulerOS-SA-2020-1823)

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open,...

CVE-2020-15908

tar/TarFileReader.cpp in Cauldron cbang aka C-Bang or C! before 1.6.0 allows Directory Traversal during extraction from a TAR archive...

CVE-2020-15908

tar/TarFileReader.cpp in Cauldron cbang aka C-Bang or C! before 1.6.0 allows Directory Traversal during extraction from a TAR archive...

Directory traversal

tar/TarFileReader.cpp in Cauldron cbang aka C-Bang or C! before 1.6.0 allows Directory Traversal during extraction from a TAR archive...

CVE-2020-15908

CVE-2020-15908 affects Cauldron cbang (aka C-Bang or C!) prior to version 1.6.0. The issue is a Directory Traversal in TarFileReader.cpp during extraction of TAR archives. CVSS metrics indicate CVSS‑3.1 base score 7.5 (HIGH) with network exposure, no privileges required, and no user interaction. ...

CVE-2020-15908

tar/TarFileReader.cpp in Cauldron cbang aka C-Bang or C! before 1.6.0 allows Directory Traversal during extraction from a TAR archive...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Python vulnerabilities (USN-4428-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4428-1 advisory. It was discovered that Python documentation had a misleading information. A security issue could be possibly caused by wrong...

USN-4428-1: Python vulnerabilities

It was discovered that Python documentation had a misleading information. A security issue could be possibly caused by wrong assumptions of this information. This issue only affected Ubuntu 12.04 ESM, Ubuntu 14.04 ESM, Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. CVE-2019-17514 It was discovered that...

USN-4428-1 python2.7, python3.4, python3.5, python3.6, python3.8 vulnerabilities

It was discovered that Python documentation had a misleading information. A security issue could be possibly caused by wrong assumptions of this information. This issue only affected Ubuntu 12.04 ESM, Ubuntu 14.04 ESM, Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. CVE-2019-17514 It was discovered that...

Python <= 3.8.3 DoS Vulnerability - Linux

Python is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...