VuXML ID | Description |
0e561173-0fa9-11ec-a2fa-080027948c12 | Python -- multiple vulnerabilities
Python reports:
bpo-44394: Update the vendored copy of libexpat to 2.4.1 (from 2.2.8) to get the
fix for the CVE-2013-0340 "Billion Laughs" vulnerability. This copy is most used
on Windows and macOS.
bpo-43124: Made the internal putcmd function in smtplib sanitize input for
presence of \r and \n characters to avoid (unlikely) command injection.
Discovery 2021-08-30 Entry 2021-09-07 python36
< 3.6.15
python37
< 3.7.12
https://docs.python.org/3.6/whatsnew/changelog.html#changelog
https://docs.python.org/3.7/whatsnew/changelog.html#changelog
|
33c05d57-bf6e-11ea-ba1e-0800273f78d3 | Python -- multiple vulnerabilities
Python reports:
The AbstractBasicAuthHandler class of the urllib.request module uses an inefficient
regular expression which can be exploited by an attacker to cause a denial of service.
Fix the regex to prevent the catastrophic backtracking. Vulnerability reported by Ben
Caller and Matt Schwager.
Disallow control characters in hostnames in http.client, addressing CVE-2019-18348.
Such potentially malicious header injection URLs now cause a InvalidURL to be raised.
Disallow CR or LF in email.headerregistry.Address arguments to guard against header
injection attacks.
Discovery 2019-10-24 Entry 2020-07-06 python37
< 3.7.8
https://docs.python.org/3.7/whatsnew/changelog.html#changelog
CVE-2019-18348
CVE-2020-8492
|
3fcb70a4-e22d-11ea-98b2-080027846a02 | Python -- multiple vulnerabilities
Python reports:
bpo-29778: Ensure python3.dll is loaded from correct locations when
Python is embedded (CVE-2020-15523).
bpo-41004: CVE-2020-14422: The __hash__() methods of ipaddress.IPv4Interface
and ipaddress.IPv6Interface incorrectly generated constant hash values
of 32 and 128 respectively. This resulted in always causing hash collisions.
The fix uses hash() to generate hash values for the tuple of (address, mask
length, network address).
bpo-39603: Prevent http header injection by rejecting control characters
in http.client.putrequest(...).
Discovery 2020-06-17 Entry 2020-08-19 python37
< 3.7.9
python36
< 3.6.12
https://docs.python.org/release/3.7.9/whatsnew/changelog.html#changelog
https://docs.python.org/release/3.6.12/whatsnew/changelog.html#changelog
CVE-2020-14422
CVE-2020-15523
|
9b7491fb-f253-11e9-a50c-000c29c4dc65 | python 3.7 -- multiple vulnerabilities
Python changelog:
bpo-38243: Escape the server title of xmlrpc.server.DocXMLRPCServer when rendering
the document page as HTML.
bpo-38174: Update vendorized expat library version to 2.2.8, which resolves
CVE-2019-15903.
bpo-37764: Fixes email._header_value_parser.get_unstructured going into an infinite
loop for a specific case in which the email header does not have trailing whitespace,
and the case in which it contains an invalid encoded word.
bpo-37461: Fix an infinite loop when parsing specially crafted email headers.
bpo-34155: Fix parsing of invalid email addresses with more than one @
(e.g. a@b@c.com.) to not return the part before 2nd @ as valid email address.
Discovery 2019-09-14 Entry 2019-10-19 python37
< 3.7.5
https://docs.python.org/3.7/whatsnew/changelog.html#python-3-7-5-final
CVE-2019-15903
|
a27b0bb6-84fc-11ea-b5b4-641c67a117d8 | Python -- Regular Expression DoS attack against client
Ben Caller and Matt Schwager reports:
Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7
through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct
Regular Expression Denial of Service (ReDoS) attacks against a client
because of urllib.request.AbstractBasicAuthHandler catastrophic
backtracking.
Discovery 2019-11-17 Entry 2020-04-23 Modified 2020-06-13 python38
< 3.8.3
python37
le 3.7.7
python36
< 3.6.10
python35
le 3.5.9_4
python27
< 2.7.18
https://python-security.readthedocs.io/vuln/urllib-basic-auth-regex.html
https://bugs.python.org/issue39503
CVE-2020-8492
ports/245819
|
a449c604-a43a-11e9-b422-fcaa147e860e | python 3.7 -- multiple vulnerabilities
Python changelog:
bpo-37463: ssl.match_hostname() no longer accepts IPv4 addresses with additional text
after the address and only quad-dotted notation without trailing whitespaces. Some
inet_aton() implementations ignore whitespace and all data after whitespace, e.g.'127.0.0.1
whatever'.
bpo-35907: CVE-2019-9948: Avoid file reading by disallowing local-file:// and
local_file:// URL schemes in URLopener().open() and URLopener().retrieve() of
urllib.request.
bpo-36742: Fixes mishandling of pre-normalization characters in urlsplit().
bpo-30458: Address CVE-2019-9740 by disallowing URL paths with embedded whitespace
or control characters through into the underlying http client request. Such potentially
malicious header injection URLs now cause an http.client.InvalidURL exception to be
raised.
bpo-33529: Prevent fold function used in email header encoding from entering infinite
loop when there are too many non-ASCII characters in a header.
bpo-35755: shutil.which() now uses os.confstr("CS_PATH") if available and if the PATH
environment variable is not set. Remove also the current directory from posixpath.defpath.
On Unix, shutil.which() and the subprocess module no longer search the executable in the
current directory if the PATH environment variable is not set.
Discovery 2019-03-13 Entry 2019-07-12 python37
< 3.7.4
https://docs.python.org/3.7/whatsnew/changelog.html#python-3-7-4-final
CVE-2019-9740
CVE-2019-9948
|
ca595a25-91d8-11ea-b470-080027846a02 | Python -- CRLF injection via the host part of the url passed to urlopen()
Python reports:
An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x
through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as
demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in
the host component of a URL) followed by an HTTP header.
Discovery 2019-10-24 Entry 2020-05-09 Modified 2020-06-13 python27
< 2.7.18
python38
< 3.8.3
python37
le 3.7.7
python36
< 3.6.10
python35
le 3.5.9_4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18348
https://bugs.python.org/issue38576
CVE-2019-18348
|
d74371d2-4fee-11e9-a5cd-1df8a848de3d | Python -- NULL pointer dereference vulnerability
Python Changelog:
bpo-35746: [CVE-2019-5010] Fix a NULL pointer deref in ssl module. The
cert parser did not handle CRL distribution points with empty DP or URI
correctly. A malicious or buggy certificate can result into segfault.
Vulnerability (TALOS-2018-0758) reported by Colin Read and Nicolas Edet
of Cisco.
Discovery 2019-01-15 Entry 2019-03-26 Modified 2019-03-27 python27
< 2.7.16
python35
< 3.5.7
python36
< 3.6.8_1
python37
< 3.7.3
https://docs.python.org/3.7/whatsnew/changelog.html
https://bugs.python.org/issue35746
CVE-2019-5010
|