DLA-3771-1 python2.7 - security update
Published
Unknown
Product
debian/python2.7 vulnerabilities
54 published CVES affecting debian/python2.7, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 54
- Critical
- 8
- High
- 9
- Medium
- 20
- Low
- 3
- Unscored
- 14
- CISA KEV
- 0
Latest debian/python2.7 CVEs
Newest publication first · page 1 of 3
-
-
DLA-3575-1 python2.7 - security update
PublishedUnknown -
HighCVSS 7.5 EPSS 2.0%
A use-after-free exists in Python through 3.9 via heappushpop in heapq.
-
DLA-3432-1 python2.7 - security update
PublishedUnknown -
DLA-2919-1 python2.7 - security update
PublishedUnknown -
DLA-2628-1 python2.7 - security update
PublishedUnknown -
CriticalCVSS 9.8 EPSS 24.0%
Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occu...
-
DLA-2337-1 python2.7 - security update
PublishedUnknown -
HighCVSS 7.5 EPSS 3.5%
The gzip_decode function in the xmlrpc client library in Python 3.4 and earlier allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP request.
-
CriticalCVSS 9.8 EPSS 23.9%
The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character...
-
HighCVSS 7.5 EPSS 5.6%
Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb.
-
MediumCVSS 6.5 EPSS 6.6%
Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtr...
-
MediumCVSS 6.1 EPSS 4.5%
The CGIHandler class in Python before 2.7.12 does not protect against the HTTP_PROXY variable name clash in a CGI script, which could allow a remote attacker to redirect HTTP requests.
-
HighCVSS 7.5 EPSS 20.7%
An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connection...
-
MediumCVSS 6.1 EPSS 3.5%
An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the host compone...
-
DLA-1925-1 python2.7 - security update
PublishedUnknown -
HighCVSS 7.5 EPSS 5.1%
An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on t...
-
DLA-1906-1 python2.7 - security update
PublishedUnknown -
MediumCVSS 5.3 EPSS 3.7%
http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this flaw by using a server with a hostname that has an...
-
DLA-1834-1 python2.7 - security update
PublishedUnknown -
CriticalCVSS 9.8 EPSS 5.2%
A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password...
-
CriticalCVSS 9.1 EPSS 11.8%
urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.
-
MediumCVSS 6.1 EPSS 5.3%
An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the path compone...
-
MediumCVSS 6.1 EPSS 5.4%
An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the query string...
-
CriticalCVSS 9.8 EPSS 7.7%
Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The component...
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.