Search CVE reports
1 – 10 of 154 results
The http.cookies.Morsel class allows separator semicolons in attribute values and includes them verbatim in all output formats. An attacker who can control these values could use this to relax the cookie's Domain or SameSite restrictions.
11 affected packages
python2.7, python3.4, python3.5, python3.6, python3.7...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| python2.7 | Not in release | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
| python3.4 | Not in release | Not in release | Not in release | — | — |
| python3.5 | Not in release | Not in release | Not in release | — | — |
| python3.6 | Not in release | Not in release | Not in release | — | Needs evaluation |
| python3.7 | Not in release | Not in release | Not in release | — | Needs evaluation |
| python3.8 | Not in release | Not in release | Not in release | Needs evaluation | Needs evaluation |
| python3.9 | Not in release | Not in release | Not in release | Needs evaluation | — |
| python3.10 | Not in release | Not in release | Needs evaluation | — | — |
| python3.11 | Not in release | Not in release | Needs evaluation | — | — |
| python3.12 | Not in release | Needs evaluation | Not in release | — | — |
| python3.14 | Needs evaluation | Not in release | Not in release | — | — |
When ca_certs parameter was supplied to ssl.get_server_certificate() function, the identity of the certificate is not checked.
11 affected packages
python2.7, python3.4, python3.5, python3.6, python3.7...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| python2.7 | Not in release | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
| python3.4 | Not in release | Not in release | Not in release | — | — |
| python3.5 | Not in release | Not in release | Not in release | — | — |
| python3.6 | Not in release | Not in release | Not in release | — | Needs evaluation |
| python3.7 | Not in release | Not in release | Not in release | — | Needs evaluation |
| python3.8 | Not in release | Not in release | Not in release | Needs evaluation | Needs evaluation |
| python3.9 | Not in release | Not in release | Not in release | Needs evaluation | — |
| python3.10 | Not in release | Not in release | Needs evaluation | — | — |
| python3.11 | Not in release | Not in release | Needs evaluation | — | — |
| python3.12 | Not in release | Needs evaluation | Not in release | — | — |
| python3.14 | Needs evaluation | Not in release | Not in release | — | — |
http.cookiejar.CookieJar deleted a stored cookie when a response carried an already expired Set-Cookie header for it, using the Domain and Path attributes from the header without consulting the cookie policy. A server could...
11 affected packages
python2.7, python3.4, python3.5, python3.6, python3.7...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| python2.7 | Not in release | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
| python3.4 | Not in release | Not in release | Not in release | — | — |
| python3.5 | Not in release | Not in release | Not in release | — | — |
| python3.6 | Not in release | Not in release | Not in release | — | Needs evaluation |
| python3.7 | Not in release | Not in release | Not in release | — | Needs evaluation |
| python3.8 | Not in release | Not in release | Not in release | Needs evaluation | Needs evaluation |
| python3.9 | Not in release | Not in release | Not in release | Needs evaluation | — |
| python3.10 | Not in release | Not in release | Needs evaluation | — | — |
| python3.11 | Not in release | Not in release | Needs evaluation | — | — |
| python3.12 | Not in release | Needs evaluation | Not in release | — | — |
| python3.14 | Needs evaluation | Not in release | Not in release | — | — |
When tarfile or zipfile command line interface (CLI) is used to decompress an archive, a Python script shadowing the stdlib can be created. Then if an error occurs during decompressing the next file, the newly created Python...
11 affected packages
python2.7, python3.4, python3.5, python3.6, python3.7...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| python2.7 | Not in release | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
| python3.4 | Not in release | Not in release | Not in release | — | — |
| python3.5 | Not in release | Not in release | Not in release | — | — |
| python3.6 | Not in release | Not in release | Not in release | — | Needs evaluation |
| python3.7 | Not in release | Not in release | Not in release | — | Needs evaluation |
| python3.8 | Not in release | Not in release | Not in release | Needs evaluation | Needs evaluation |
| python3.9 | Not in release | Not in release | Not in release | Needs evaluation | — |
| python3.10 | Not in release | Not in release | Needs evaluation | — | — |
| python3.11 | Not in release | Not in release | Needs evaluation | — | — |
| python3.12 | Not in release | Needs evaluation | Not in release | — | — |
| python3.14 | Needs evaluation | Not in release | Not in release | — | — |
IMAP4.starttls() wraps the socket in TLS but leaves self._readbuf, imaplib's own read-ahead buffer, untouched. Any plaintext bytes that arrived in the same recv() as the tagged OK to STARTTLS are returned by readline() after the...
11 affected packages
python2.7, python3.4, python3.5, python3.6, python3.7...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| python2.7 | Not in release | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
| python3.4 | Not in release | Not in release | Not in release | — | — |
| python3.5 | Not in release | Not in release | Not in release | — | — |
| python3.6 | Not in release | Not in release | Not in release | — | Needs evaluation |
| python3.7 | Not in release | Not in release | Not in release | — | Needs evaluation |
| python3.8 | Not in release | Not in release | Not in release | Needs evaluation | Needs evaluation |
| python3.9 | Not in release | Not in release | Not in release | Needs evaluation | — |
| python3.10 | Not in release | Not in release | Needs evaluation | — | — |
| python3.11 | Not in release | Not in release | Needs evaluation | — | — |
| python3.12 | Not in release | Needs evaluation | Not in release | — | — |
| python3.14 | Needs evaluation | Not in release | Not in release | — | — |
There was a regression in how FIPS algorithms were enforced for the hashlib module. Only users that are using OpenSSL in FIPS mode are affected. Only Python 3.14.10 is affected, all other Python versions are unaffected.
11 affected packages
python2.7, python3.4, python3.5, python3.6, python3.7...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| python2.7 | Not in release | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
| python3.4 | Not in release | Not in release | Not in release | — | — |
| python3.5 | Not in release | Not in release | Not in release | — | — |
| python3.6 | Not in release | Not in release | Not in release | — | Needs evaluation |
| python3.7 | Not in release | Not in release | Not in release | — | Needs evaluation |
| python3.8 | Not in release | Not in release | Not in release | Needs evaluation | Needs evaluation |
| python3.9 | Not in release | Not in release | Not in release | Needs evaluation | — |
| python3.10 | Not in release | Not in release | Needs evaluation | — | — |
| python3.11 | Not in release | Not in release | Needs evaluation | — | — |
| python3.12 | Not in release | Needs evaluation | Not in release | — | — |
| python3.14 | Needs evaluation | Not in release | Not in release | Not in release | Not in release |
A use of uninitialized memory vulnerability in the pybddisasm Python bindings affects nd_to_text. If the underlying text conversion fails, including failures caused by invalid parameters, the output buffer may remain uninitialized...
11 affected packages
python2.7, python3.4, python3.5, python3.6, python3.7...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| python2.7 | Not in release | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
| python3.4 | Not in release | Not in release | Not in release | — | — |
| python3.5 | Not in release | Not in release | Not in release | — | — |
| python3.6 | Not in release | Not in release | Not in release | — | Needs evaluation |
| python3.7 | Not in release | Not in release | Not in release | — | Needs evaluation |
| python3.8 | Not in release | Not in release | Not in release | Needs evaluation | Needs evaluation |
| python3.9 | Not in release | Not in release | Not in release | Needs evaluation | — |
| python3.10 | Not in release | Not in release | Needs evaluation | — | — |
| python3.11 | Not in release | Not in release | Needs evaluation | — | — |
| python3.12 | Not in release | Needs evaluation | Not in release | — | — |
| python3.14 | Needs evaluation | Not in release | Not in release | — | — |
A use of uninitialized memory vulnerability in the pybddisasm Python bindings may disclose process memory when instruction decoding fails. The nd_decode, nd_decode_ex, nd_decode_ex2, and nd_decode_with_context functions may return...
11 affected packages
python2.7, python3.4, python3.5, python3.6, python3.7...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| python2.7 | Not in release | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
| python3.4 | Not in release | Not in release | Not in release | — | — |
| python3.5 | Not in release | Not in release | Not in release | — | — |
| python3.6 | Not in release | Not in release | Not in release | — | Needs evaluation |
| python3.7 | Not in release | Not in release | Not in release | — | Needs evaluation |
| python3.8 | Not in release | Not in release | Not in release | Needs evaluation | Needs evaluation |
| python3.9 | Not in release | Not in release | Not in release | Needs evaluation | — |
| python3.10 | Not in release | Not in release | Needs evaluation | — | — |
| python3.11 | Not in release | Not in release | Needs evaluation | — | — |
| python3.12 | Not in release | Needs evaluation | Not in release | — | — |
| python3.14 | Needs evaluation | Not in release | Not in release | — | — |
Out-of-bounds read vulnerabilities in the pybddisasm Python bindings may disclose adjacent process memory during instruction decoding. The nd_decode function may read up to 15 bytes without checking the actual length of...
11 affected packages
python2.7, python3.4, python3.5, python3.6, python3.7...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| python2.7 | Not in release | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
| python3.4 | Not in release | Not in release | Not in release | — | — |
| python3.5 | Not in release | Not in release | Not in release | — | — |
| python3.6 | Not in release | Not in release | Not in release | — | Needs evaluation |
| python3.7 | Not in release | Not in release | Not in release | — | Needs evaluation |
| python3.8 | Not in release | Not in release | Not in release | Needs evaluation | Needs evaluation |
| python3.9 | Not in release | Not in release | Not in release | Needs evaluation | — |
| python3.10 | Not in release | Not in release | Needs evaluation | — | — |
| python3.11 | Not in release | Not in release | Needs evaluation | — | — |
| python3.12 | Not in release | Needs evaluation | Not in release | — | — |
| python3.14 | Needs evaluation | Not in release | Not in release | — | — |
socket.getaddrinfo() previously accepted null bytes within *host* and *port* parameters which can cause the values to be silently truncated.
12 affected packages
python2.7, python3.4, python3.5, python3.6, python3.7...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| python2.7 | Not in release | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
| python3.4 | Not in release | Not in release | Not in release | — | — |
| python3.5 | Not in release | Not in release | Not in release | — | — |
| python3.6 | Not in release | Not in release | Not in release | — | Needs evaluation |
| python3.7 | Not in release | Not in release | Not in release | — | Needs evaluation |
| python3.8 | Not in release | Not in release | Not in release | Needs evaluation | Needs evaluation |
| python3.9 | Not in release | Not in release | Not in release | Needs evaluation | — |
| python3.10 | Not in release | Not in release | Needs evaluation | — | — |
| python3.11 | Not in release | Not in release | Needs evaluation | — | — |
| python3.12 | Not in release | Needs evaluation | Not in release | — | — |
| python3.14 | Needs evaluation | Not in release | Not in release | — | — |
| python3.15 | Not in release | Not in release | Not in release | — | — |