rpm package
suse/python3&distro=SUSE Linux Enterprise Software Development Kit 12 SP4
pkg:rpm/suse/python3&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP4
Vulnerabilities (17)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2019-9674 | — | < 3.4.10-25.45.1 | 3.4.10-25.45.1 | Feb 4, 2020 | Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb. | ||
| CVE-2020-8492 | — | < 3.4.10-25.45.1 | 3.4.10-25.45.1 | Jan 30, 2020 | Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtr | ||
| CVE-2019-5010 | — | < 3.4.6-25.21.1 | 3.4.6-25.21.1 | Oct 31, 2019 | An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connection | ||
| CVE-2019-18348 | — | < 3.4.10-25.45.1 | 3.4.10-25.45.1 | Oct 23, 2019 | An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the host compone | ||
| CVE-2019-16056 | — | < 3.4.6-25.34.2 | 3.4.6-25.34.2 | Sep 6, 2019 | An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on t | ||
| CVE-2018-20852 | — | < 3.4.6-25.34.2 | 3.4.6-25.34.2 | Jul 13, 2019 | http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this flaw by using a server with a hostname that has an | ||
| CVE-2019-10160 | — | < 3.4.6-25.29.1 | 3.4.6-25.29.1 | Jun 7, 2019 | A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password | ||
| CVE-2019-9636 | — | < 3.4.6-25.24.1 | 3.4.6-25.24.1 | Mar 8, 2019 | Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The component | ||
| CVE-2018-20406 | — | < 3.4.6-25.21.1 | 3.4.6-25.21.1 | Dec 23, 2018 | Modules/_pickle.c in Python before 3.7.1 has an integer overflow via a large LONG_BINPUT value that is mishandled during a "resize to twice the size" attempt. This issue might cause memory exhaustion, but is only relevant if the pickle format is used for serializing tens or hundr | ||
| CVE-2018-14647 | — | < 3.4.6-25.29.1 | 3.4.6-25.29.1 | Sep 25, 2018 | Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data struc | ||
| CVE-2018-1000802 | — | < 3.4.6-25.29.1 | 3.4.6-25.29.1 | Sep 18, 2018 | Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injecti | ||
| CVE-2016-9063 | — | < 3.4.10-25.39.3 | 3.4.10-25.39.3 | Jun 11, 2018 | An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox < 50. | ||
| CVE-2017-1000158 | Cri | 9.8 | < 3.4.10-25.39.3 | 3.4.10-25.39.3 | Nov 17, 2017 | CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code execution) | |
| CVE-2017-9233 | Hig | 7.5 | < 3.4.10-25.39.3 | 3.4.10-25.39.3 | Jul 25, 2017 | XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD. | |
| CVE-2016-4472 | Hig | 8.1 | < 3.4.10-25.39.3 | 3.4.10-25.39.3 | Jun 30, 2016 | The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML data. NOTE: this vulnerability exists because of an incomplete fix f | |
| CVE-2016-0718 | Cri | 9.8 | < 3.4.10-25.39.3 | 3.4.10-25.39.3 | May 26, 2016 | Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow. | |
| CVE-2012-0876 | — | < 3.4.10-25.39.3 | 3.4.10-25.39.3 | Jul 3, 2012 | The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML file with many identifiers with the sa |
- CVE-2019-9674Feb 4, 2020affected < 3.4.10-25.45.1fixed 3.4.10-25.45.1
Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb.
- CVE-2020-8492Jan 30, 2020affected < 3.4.10-25.45.1fixed 3.4.10-25.45.1
Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtr
- CVE-2019-5010Oct 31, 2019affected < 3.4.6-25.21.1fixed 3.4.6-25.21.1
An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connection
- CVE-2019-18348Oct 23, 2019affected < 3.4.10-25.45.1fixed 3.4.10-25.45.1
An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the host compone
- CVE-2019-16056Sep 6, 2019affected < 3.4.6-25.34.2fixed 3.4.6-25.34.2
An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on t
- CVE-2018-20852Jul 13, 2019affected < 3.4.6-25.34.2fixed 3.4.6-25.34.2
http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this flaw by using a server with a hostname that has an
- CVE-2019-10160Jun 7, 2019affected < 3.4.6-25.29.1fixed 3.4.6-25.29.1
A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password
- CVE-2019-9636Mar 8, 2019affected < 3.4.6-25.24.1fixed 3.4.6-25.24.1
Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The component
- CVE-2018-20406Dec 23, 2018affected < 3.4.6-25.21.1fixed 3.4.6-25.21.1
Modules/_pickle.c in Python before 3.7.1 has an integer overflow via a large LONG_BINPUT value that is mishandled during a "resize to twice the size" attempt. This issue might cause memory exhaustion, but is only relevant if the pickle format is used for serializing tens or hundr
- CVE-2018-14647Sep 25, 2018affected < 3.4.6-25.29.1fixed 3.4.6-25.29.1
Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data struc
- CVE-2018-1000802Sep 18, 2018affected < 3.4.6-25.29.1fixed 3.4.6-25.29.1
Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injecti
- CVE-2016-9063Jun 11, 2018affected < 3.4.10-25.39.3fixed 3.4.10-25.39.3
An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox < 50.
- affected < 3.4.10-25.39.3fixed 3.4.10-25.39.3
CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code execution)
- affected < 3.4.10-25.39.3fixed 3.4.10-25.39.3
XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD.
- affected < 3.4.10-25.39.3fixed 3.4.10-25.39.3
The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML data. NOTE: this vulnerability exists because of an incomplete fix f
- affected < 3.4.10-25.39.3fixed 3.4.10-25.39.3
Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.
- CVE-2012-0876Jul 3, 2012affected < 3.4.10-25.39.3fixed 3.4.10-25.39.3
The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML file with many identifiers with the sa