201 matches found
PSF-2022-6 CVE-2021-3733: ReDoS in urllib.request
There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client such as web browser connects to, could trigger a Regular Expression Denial of Service ReDOS during an authentication request with a specially crafted payload that is sen...
PSF-2022-7 CVE-2021-3737: urllib HTTP client possible infinite loop on a 100 Continue response
A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability...
PSF-2022-8 urllib.parse should sanitize urls containing ASCII newline and tabs.
A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator URL strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an...
PSF-2021-4 Information disclosure via pydoc getfile
There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server could access the server and use it to disclose sensitive information belonging to the other user that they would not normally be able to...
PSF-2021-2 ipaddress leading zeros in IPv4 address
In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This in some situations allows attackers to bypass access control that is based on IP addresses...
PSF-2021-5 ftplib should not use the host from the PASV response
The IPv4 address value returned from the server in response to the PASV command should not be trusted. This prevents a malicious FTP server from using the response to probe IPv4 address and port combinations on the client network. Instead of using the returned address, we use the IP address we're...
PSF-2021-1 urllib parse_qsl(): Web cache poisoning - semicolon as a query args separator
The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parseqsl and urllib.parse.parseqs by using a vector called parameter cloaking. When the attacker can...
PSF-2021-3 ctypes: Buffer overflow in PyCArg_repr
Python 3.x through 3.9.1 has a buffer overflow in PyCArgrepr in ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to cdouble.fromparam. This occurs because sprintf is...
PSF-2020-6 CJK codecs tests call eval() on content retrieved via HTTP
In Python 3 through 3.9.0, the Lib/test/multibytecodecsupport.py CJK codec tests call eval on content retrieved via HTTP...
PSF-2020-5 http.client: HTTP Header Injection in the HTTP method
http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request...
PSF-2020-2 Infinite loop in tarfile module while opening a crafted file
In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because procpax lacks header validation...
PSF-2020-4 Py_SetPath(): _Py_CheckPython3 uses uninitialized DLL path
In Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a Trojan horse python3.dll might be used in cases where CPython is embedded in a native application. This occurs because python3X.dll may use an invalid search path for python3.dll loading...
PSF-2020-3 [CVE-2020-14422] Hash collisions in IPv4Interface and IPv6Interface
Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface...
PSF-2020-1 xmlrpc gzip unlimited read
The gzipdecode function in the xmlrpc client library in Python 3.4 and earlier allows remote attackers to cause a denial of service memory consumption via a crafted HTTP request...
PSF-2020-8 urllib basic auth regex denial of service
Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service ReDoS attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking...
PSF-2020-7 CVE-2020-8315: Unsafe DLL loading in getpathp.c on Windows 7
In Python CPython 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an insecure dependency load upon launch on Windows 7 may result in an attacker's copy of api-ms-win-core-path-l1-1-0.dll being loaded and used instead of the system's copy. Windows 8 and later are unaffected...
PSF-2019-16 Email header injection in Address objects
It is possible to inject email headers using CR or LF character. The fix disallows CR and LF characters in email.headerregistry.Address arguments to guard against header injection attacks...
PSF-2019-15 Remove newline characters from uu encoding methods
Filenames passed to the UU encoding methods uu.py and uucodec.py that contain a newline character will overflow data into the UU content section. This can potentially be used to inject replace or corrupt data content in a file during the decode process. The fix removes newline characters from...
PSF-2019-2 HTTPoxy attack
The CGIHandler class in Python before 2.7.12 does not protect against the HTTPPROXY variable name clash in a CGI script, which could allow a remote attacker to redirect HTTP requests...
PSF-2019-14 Regular Expression Denial of Service in http.cookiejar
The regex http.cookiejar.LOOSEHTTPDATERE is vulnerable to regular expression denial of service "REDoS". LOOSEHTTPDATERE.match is called when using http.cookiejar.CookieJar to parse Set-Cookie headers returned by a HTTP server. Processing a response from a malicious HTTP server can lead to extreme...
PSF-2019-8 TALOS-2018-0758 SSL CRL distribution points Denial of Service
An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted...
PSF-2019-7 CVE-2019-18348: CRLF injection via the host part of the url passed to urlopen()
An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n specifically in the host component of a URL follow...
PSF-2019-6 Reflected XSS in DocXMLRPCServer
The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the servertitle field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If setservertitle is called with untrusted input, arbitrary...
PSF-2019-5 email.utils.parseaddr mistakenly parse an email
An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To header...
PSF-2019-13 ssl.match_hostname() ignores extra string after whitespace in IPv4 address
inetaton accepts trailing characters after a valid IP. Because of that, Python ssl.matchhostname'1.1.1.1 ; this should not work but does' succeeded when it should fail. The issue was introduced in bpo-32819 by commit aef1283b . Only Python 3.7 and newer are affected. It's a potential security bug...
PSF-2019-4 Windows: vulnerable bzip2 1.0.6
BZ2decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors...
PSF-2019-3 urlsplit does not handle NFKC normalization (second fix)
A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL...
PSF-2019-1 smtplib unlimited read
The smtplib module doesn't limit the amount of read data in its call to readline. An erroneous or malicious SMTP server can trick the smtplib module to consume large amounts of memory...
PSF-2019-12 urllib module local_file:// scheme
urllib in Python 2.x through 2.7.16 supports the localfile: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen'localfile:///etc/passwd' call...
PSF-2019-11 HTTP Header Injection (follow-up of CVE-2016-5699)
An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n specifically in the path component of a URL that...
PSF-2019-10 HTTP Header Injection (follow-up of CVE-2016-5699)
An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n specifically in the query string after a ? charact...
PSF-2019-9 urlsplit does not handle NFKC normalization
Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding with an incorrect netloc during NFKC normalization. The impact is: Information disclosure credentials, cookies, etc. that are cached against a given hostname. The components are:...
PSF-2019-17 http.cookiejar: Incorrect validation of path
Cookies of example.com with path=/any were sent to example.com/anybad/ while using a cookiejar with http.cookiejar.DefaultCookiePolicy policy. The code did not check for the first non-matching character in prefix match to be a slash...
PSF-2018-6 pickle.load denial of service
Modules/pickle.c in Python before 3.7.1 has an integer overflow via a large LONGBINPUT value that is mishandled during a "resize to twice the size" attempt. This issue might cause memory exhaustion, but is only relevant if the pickle format is used for serializing tens or hundreds of gigabytes of...
PSF-2018-5 _elementree C accelerator doesn't call XML_SetHashSalt()
Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming...
PSF-2018-7 xml package does not obey ignore_environment
On two occasions, the xml package uses environment variables to override parser / DOM implementations: xml.sax package and xml.dom.domreg module. On both occasions, the code should not use env vars to override module names, when the interpreter is started with flags like -E or -I...
PSF-2018-4 difflib and poplib catastrophic backtracking
python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.ISLINEJUNK method. An attacker could use this flaw to cause denial of service...
PSF-2018-3 difflib and poplib catastrophic backtracking
python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop method. An attacker could use this flaw to cause denial of service...
PSF-2018-1 Expat 2.2.1
An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox 50...
PSF-2018-8 Email folding function Denial-of-Service
The email folding function enters an infinite loop if a header is longer than the policy maximum line length and contains many non-ASCII characters. Regression introduced in Python 3.6.4...
PSF-2018-2 Python 2.7 readahead is not thread safe
Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. Python versions prior to 2.7.14 may also be vulnerable and it appears that Python 2.7.17 and prior may also be vulnerable however this has not been confirmed. The vulnerability lies when multiply threads are...
PSF-2017-6 PyString_DecodeEscape integer overflow
CPython aka Python up to 2.7.13 is vulnerable to an integer overflow in the PyStringDecodeEscape function in stringobject.c, resulting in heap-based buffer overflow and possible arbitrary code execution...
PSF-2017-1 JSONDecoder.raw_decode
Array index error in the scanstring function in the json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependent attackers to read arbitrary process memory via a negative index value in the idx argument to the rawdecode function...
PSF-2017-7 Expat 2.2.1
XML External Entity vulnerability in libexpat 2.2.0 and earlier Expat XML Parser Library allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD...
PSF-2017-11 Expat 2.2.3
Expat 2.2.2 was released with multiple security fixes: 43: Protect against compilation without any source of high quality entropy enabled, e.g. with CMake build system 60: Windows with UNICODE: Unintended use of LoadLibraryW with a non-wide string resulted in failure to load advapi32.dll and...
PSF-2017-8 Environment variables injection in subprocess on Windows
On Windows, prevent passing invalid environment variables and command arguments to subprocess.Popen. It is possible to inject an environment variable in subprocess on Windows if a user data is passed to a subprocess via environment variable. Check for invalid environment variable names containing...
PSF-2017-9 bpo-30500: urllib connects to a wrong host
The urllib module doesn't parse correctly password containing the character...
PSF-2017-5 Zlib 1.2.11
The crc32big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation...