Search CVE reports

11 – 20 of 45 results

Detailed view

Sort by:

CVE-2024-0450

Medium priority

Some fixes available 10 of 17

An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The zipfile module is vulnerable to “quoted-overlap” zip-bombs which exploit the zip format to create a...

10 affected packages

python2.7, python3.10, python3.11, python3.12, python3.4...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
python2.7	Not in release	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
python3.10	Not in release	Fixed	Not in release	—	—
python3.11	Not in release	Needs evaluation	Not in release	—	—
python3.12	Not affected	Not in release	Not in release	—	—
python3.4	Not in release	Not in release	Not in release	—	—
python3.5	Not in release	Not in release	Not in release	—	Fixed
python3.6	Not in release	Not in release	Not in release	Fixed	—
python3.7	Not in release	Not in release	Not in release	Fixed	—
python3.8	Not in release	Not in release	Fixed	Fixed	—
python3.9	Not in release	Not in release	Fixed	—	—

CVE-2023-6597

Medium priority

Some fixes available 8 of 10

An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference symlinks during cleanup of...

10 affected packages

python2.7, python3.10, python3.11, python3.12, python3.4...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
python2.7	Not in release	Not affected	Not affected	Not affected	Not affected
python3.10	Not in release	Fixed	Not in release	—	—
python3.11	Not in release	Needs evaluation	Not in release	—	—
python3.12	Not affected	Not in release	Not in release	—	—
python3.4	Not in release	Not in release	Not in release	—	—
python3.5	Not in release	Not in release	Not in release	—	Fixed
python3.6	Not in release	Not in release	Not in release	Not affected	—
python3.7	Not in release	Not in release	Not in release	Fixed	—
python3.8	Not in release	Not in release	Fixed	Fixed	—
python3.9	Not in release	Not in release	Fixed	—	—

CVE-2023-6507

Medium priority

Fixed

An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases. When using the `extra_groups=` parameter with an empty list as a value...

6 affected packages

python2.7, python3.10, python3.11, python3.12, python3.7, python3.9

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
python2.7	Not in release	Not affected	Not affected	Not affected	Not affected
python3.10	Not in release	Not affected	Not in release	Ignored	Ignored
python3.11	Not in release	Not affected	Not in release	Ignored	Ignored
python3.12	Not affected	Not in release	Not in release	Ignored	Ignored
python3.7	Not in release	Not in release	Not in release	Not affected	Ignored
python3.9	Not in release	Not in release	Not affected	Ignored	Ignored

CVE-2023-40217

Medium priority

Some fixes available 12 of 16

An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If a TLS server-side...

10 affected packages

python2.7, python3.10, python3.11, python3.12, python3.4...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
python2.7	Not in release	Needs evaluation	Needs evaluation	Fixed	Fixed
python3.10	Not in release	Fixed	Not in release	Ignored	Ignored
python3.11	Not in release	Vulnerable	Not in release	Ignored	Ignored
python3.12	Not affected	Not in release	Not in release	Ignored	Ignored
python3.4	Not in release	Not in release	Not in release	Not in release	Not in release
python3.5	Not in release	Not in release	Not in release	Not in release	Fixed
python3.6	Not in release	Not in release	Not in release	Fixed	Not in release
python3.7	Not in release	Not in release	Not in release	Fixed	Ignored
python3.8	Not in release	Not in release	Fixed	Fixed	Not in release
python3.9	Not in release	Not in release	Fixed	Ignored	Ignored

CVE-2023-41105

Medium priority

Some fixes available 1 of 2

An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.normpath(), the path will be truncated unexpectedly at the first '\0' byte. There are plausible cases in which...

11 affected packages

python, python2.7, python3.10, python3.11, python3.12...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
python	Not in release	Not in release	Not in release	Ignored	Ignored
python2.7	Not in release	Not affected	Not affected	Not affected	Not affected
python3.10	Not in release	Not affected	Not in release	Not in release	Not in release
python3.11	Not in release	Vulnerable	Not in release	Not in release	Not in release
python3.12	Not affected	Not in release	Not in release	Not in release	Not in release
python3.4	Not in release	Not in release	Not in release	Not in release	Not in release
python3.5	Not in release	Not in release	Not in release	Not in release	Not affected
python3.6	Not in release	Not in release	Not in release	Not affected	Not in release
python3.7	Not in release	Not in release	Not in release	Not affected	Not in release
python3.8	Not in release	Not in release	Not affected	Not affected	Not in release
python3.9	Not in release	Not in release	Not affected	Not in release	Not in release

CVE-2022-48566

Medium priority

Some fixes available 8 of 12

An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possible in the accumulator variable in hmac.compare_digest.

11 affected packages

python, python2.7, python3.10, python3.11, python3.12...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
python	Not in release	Not in release	Not in release	Ignored	Ignored
python2.7	Not in release	Needs evaluation	Needs evaluation	Fixed	Fixed
python3.10	Not in release	Not affected	Not in release	Not in release	Not in release
python3.11	Not in release	Not affected	Not in release	Not in release	Not in release
python3.12	Not affected	Not in release	Not in release	Not in release	Not in release
python3.4	Not in release	Not in release	Not in release	Not in release	Not in release
python3.5	Not in release	Not in release	Not in release	Not in release	Fixed
python3.6	Not in release	Not in release	Not in release	Fixed	Not in release
python3.7	Not in release	Not in release	Not in release	Fixed	Not in release
python3.8	Not in release	Not in release	Fixed	Fixed	Not in release
python3.9	Not in release	Not in release	Not affected	Not in release	Not in release

CVE-2022-48565

Medium priority

Some fixes available 9 of 12

An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities.

11 affected packages

python, python2.7, python3.10, python3.11, python3.12...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
python	Not in release	Not in release	Not in release	Ignored	Ignored
python2.7	Not in release	Needs evaluation	Needs evaluation	Fixed	Fixed
python3.10	Not in release	Not affected	Not in release	Not in release	Not in release
python3.11	Not in release	Not affected	Not in release	Not in release	Not in release
python3.12	Not affected	Not in release	Not in release	Not in release	Not in release
python3.4	Not in release	Not in release	Not in release	Not in release	Not in release
python3.5	Not in release	Not in release	Not in release	Not in release	Fixed
python3.6	Not in release	Not in release	Not in release	Fixed	Not in release
python3.7	Not in release	Not in release	Not in release	Fixed	Not in release
python3.8	Not in release	Not in release	Not affected	Fixed	Not in release
python3.9	Not in release	Not in release	Fixed	Not in release	Not in release

CVE-2022-48564

Medium priority

Some fixes available 8 of 11

read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property List files in binary format.

11 affected packages

python, python2.7, python3.10, python3.11, python3.12...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
python	Not in release	Not in release	Not in release	Ignored	Ignored
python2.7	Not in release	Needs evaluation	Needs evaluation	Fixed	Fixed
python3.10	Not in release	Not affected	Not in release	Not in release	Not in release
python3.11	Not in release	Not affected	Not in release	Not in release	Not in release
python3.12	Not affected	Not in release	Not in release	Not in release	Not in release
python3.4	Not in release	Not in release	Not in release	Not in release	Not in release
python3.5	Not in release	Not in release	Not in release	Not in release	Fixed
python3.6	Not in release	Not in release	Not in release	Fixed	Not in release
python3.7	Not in release	Not in release	Not in release	Fixed	Not in release
python3.8	Not in release	Not in release	Not affected	Fixed	Not in release
python3.9	Not in release	Not in release	Not affected	Not in release	Not in release

CVE-2022-48560

Medium priority

Some fixes available 8 of 11

A use-after-free exists in Python through 3.9 via heappushpop in heapq.

11 affected packages

python, python2.7, python3.10, python3.11, python3.12...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
python	Not in release	Not in release	Not in release	Ignored	Ignored
python2.7	Not in release	Needs evaluation	Needs evaluation	Fixed	Fixed
python3.10	Not in release	Not affected	Not in release	Not in release	Not in release
python3.11	Not in release	Not affected	Not in release	Not in release	Not in release
python3.12	Not affected	Not in release	Not in release	Not in release	Not in release
python3.4	Not in release	Not in release	Not in release	Not in release	Not in release
python3.5	Not in release	Not in release	Not in release	Not in release	Fixed
python3.6	Not in release	Not in release	Not in release	Fixed	Not in release
python3.7	Not in release	Not in release	Not in release	Fixed	Not in release
python3.8	Not in release	Not in release	Not affected	Fixed	Not in release
python3.9	Not in release	Not in release	Not affected	Not in release	Not in release

CVE-2023-38898

Medium priority

Not affected

** DISPUTED ** An issue in Python cpython v.3.7 allows an attacker to obtain sensitive information via the _asyncio._swap_current_task component. NOTE: this is disputed by the vendor because (1) neither 3.7 nor any other release...

11 affected packages

python, python2.7, python3.10, python3.11, python3.12...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
python	Not in release	Not in release	Not in release	Ignored	Ignored
python2.7	Not in release	Not affected	Not affected	Not affected	Not affected
python3.10	Not in release	Not affected	Not in release	Not in release	Not in release
python3.11	Not in release	Not affected	Not in release	Not in release	Not in release
python3.12	Not affected	Not in release	Not in release	Not in release	Not in release
python3.4	Not in release	Not in release	Not in release	Not in release	Not in release
python3.5	Not in release	Not in release	Not in release	Not in release	Not affected
python3.6	Not in release	Not in release	Not in release	Not affected	Not in release
python3.7	Not in release	Not in release	Not in release	Not affected	Not in release
python3.8	Not in release	Not in release	Not affected	Not affected	Not in release
python3.9	Not in release	Not in release	Not affected	Not in release	Not in release

Export to JSON

Results by page: