Browse CVEs

MEDIUM 5.9 CVE-2020-14422EPSS 13% Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote a… Python 3.5.10 / 3.6.12+ Fix from $1,6002020-06-18 CRITICAL 9.8 CVE-2020-13388 An exploitable vulnerability exists in the configuration-loading functionality of the jw.util package before 2.3 for Python. When loading a configura… Jw.util 2.3+ Fix from $2,3002020-05-22 HIGH 7.5 CVE-2013-1753 The gzip_decode function in the xmlrpc client library in Python 3.4 and earlier allows remote attackers to cause a denial of service (memory consumpt… Python 2.7.9 / 3.2.6+ Fix from $1,9502020-03-11 HIGH 7.5 CVE-2020-7212 The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through 1.25.7 for Python allows a denial of service (CPU consumption… Urllib3 after 1.25.7 Fix from $1,9502020-03-06 CRITICAL 9.8 CVE-2014-4650EPSS 25% The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remo… Python 2.7.8 / 3.2.6+ Fix from $2,3002020-02-20 HIGH 7.5 CVE-2019-9674EPSS 6% Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb. Python after 3.8 Fix from $1,9502020-02-04 MEDIUM 6.5 CVE-2020-8492EPSS 7% Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular E… Python after 3.8.1 Fix from $1,6002020-01-30 MEDIUM 5.5 CVE-2020-8315 In Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an insecure dependency load upon launch on Windows 7 may result in … Python after 3.8.1 Fix from $1,6002020-01-28 HIGH 7.5 CVE-2013-1895 The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via mul… Py Bcrypt 0.3+ Fix from $1,9502020-01-28 HIGH 7.5 CVE-2019-19911 There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the nu… Pillow 6.2.2+ Fix from $1,9502020-01-05 CRITICAL 9.8 CVE-2020-5311 libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow. Pillow 6.2.2+ Fix from $2,3002020-01-03 CRITICAL 9.8 CVE-2020-5312 libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow. Pillow 6.2.2+ Fix from $2,3002020-01-03 HIGH 8.8 CVE-2020-5310 libImaging/TiffDecode.c in Pillow before 6.2.2 has a TIFF decoding integer overflow, related to realloc. Pillow 6.2.2+ Fix from $1,9502020-01-03 HIGH 7.1 CVE-2020-5313 libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow. Pillow 6.2.2+ Fix from $1,9502020-01-03 MEDIUM 6.1 CVE-2016-1000110 The CGIHandler class in Python before 2.7.12 does not protect against the HTTP_PROXY variable name clash in a CGI script, which could allow a remote … Python 2.7.13 / 3.3.7+ Fix from $1,6002019-11-27 HIGH 7.5 CVE-2019-19274 typed_ast 1.3.0 and 1.3.1 has a handle_keywordonly_args out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Pytho… Typed Ast Patch available Fix from $1,9502019-11-26 HIGH 7.5 CVE-2019-19275 typed_ast 1.3.0 and 1.3.1 has an ast_for_arguments out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python sou… Typed Ast Patch available Fix from $1,9502019-11-26 MEDIUM 6.2 CVE-2012-5578 Python keyring has insecure permissions on new databases allowing world-readable files to be created Keyring after 0.10 Fix from $1,6002019-11-25 HIGH 7.5 CVE-2012-0877 PyXML: Hash table collisions CPU usage Denial of Service Pyxml Mitigation only Fix from $1,9502019-11-22 HIGH 7.5 CVE-2019-5010EPSS 21% An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 ce… Python 2.7.16 / 3.4.10+ Fix from $1,9502019-10-31 HIGH 7.5 CVE-2012-5577 Python keyring lib before 0.10 created keyring files with world-readable permissions. Keyring 0.10+ Fix from $1,9502019-10-28 MEDIUM 6.1 CVE-2019-18348 An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker co… Python 3.5.10 / 3.6.11+ Fix from $1,6002019-10-23 HIGH 7.5 CVE-2019-17514 library/glob.html in the Python 2 and 3 documentation before 2016 has potentially misleading information about whether sorting occurs, as demonstrate… Python No fix yet Fix from $1,9502019-10-12 HIGH 7.5 CVE-2019-16865 An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amount… Pillow 6.2.0+ Fix from $1,9502019-10-04 MEDIUM 6.1 CVE-2019-16935 The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs… Python 2.7.17 / 3.5.8+ Fix from $1,6002019-09-28 HIGH 7.5 CVE-2019-16056EPSS 5% An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses em… Python after 4.3 Fix from $1,9502019-09-06 HIGH 7.5 CVE-2019-15903EPSS 7% In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to… Python 2.2.8 / 2.7.17+ Fix from $1,9502019-09-04 HIGH 8.8 CVE-2019-10138 A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API lacked suf… Novajoin 1.1.1+ Fix from $1,9502019-07-30 MEDIUM 5.3 CVE-2018-20852 http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be trick… Python 3.4.10 / 3.5.7+ Fix from $1,6002019-07-13 HIGH 7.8 CVE-2019-13404 The MSI installer for Python through 2.7.16 on Windows defaults to the C:\Python27 directory, which makes it easier for local users to deploy Trojan … Python 3.5.0+ Fix from $1,9502019-07-08