rpm package
suse/python311-core&distro=SUSE Linux Enterprise Module for Basesystem 15 SP7
pkg:rpm/suse/python311-core&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP7
Vulnerabilities (27)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2025-6069 | Med | 4.3 | < 3.11.13-150600.3.35.1 | 3.11.13-150600.3.35.1 | Jun 17, 2025 | The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service. | |
| CVE-2025-4517 | Cri | 9.4 | < 3.11.13-150600.3.30.1 | 3.11.13-150600.3.30.1 | Jun 3, 2025 | Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data". You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= param | |
| CVE-2025-4435 | Hig | 7.5 | < 3.11.13-150600.3.35.1 | 3.11.13-150600.3.35.1 | Jun 3, 2025 | When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior is that any filtered members would be skipped and not extracted. However the actual behavior of TarFile.errorlevel = 0 in affected versions is that the member would still be extracted and not | |
| CVE-2025-4330 | Hig | 7.5 | < 3.11.13-150600.3.30.1 | 3.11.13-150600.3.30.1 | Jun 3, 2025 | Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extrac | |
| CVE-2025-4138 | Hig | 7.5 | < 3.11.13-150600.3.30.1 | 3.11.13-150600.3.30.1 | Jun 3, 2025 | Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extrac | |
| CVE-2024-12718 | Med | 5.3 | < 3.11.13-150600.3.30.1 | 3.11.13-150600.3.30.1 | Jun 3, 2025 | Allows modifying some file metadata (e.g. last modified) with filter="data" or file permissions (chmod) with filter="tar" of files outside the extraction directory. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile. | |
| CVE-2025-4516 | Med | — | < 3.11.13-150600.3.30.1 | 3.11.13-150600.3.30.1 | May 15, 2025 | There is an issue in CPython when using `bytes.decode("unicode_escape", error="ignore|replace")`. If you are not using the "unicode_escape" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap th |
- affected < 3.11.13-150600.3.35.1fixed 3.11.13-150600.3.35.1
The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service.
- affected < 3.11.13-150600.3.30.1fixed 3.11.13-150600.3.30.1
Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data". You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= param
- affected < 3.11.13-150600.3.35.1fixed 3.11.13-150600.3.35.1
When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior is that any filtered members would be skipped and not extracted. However the actual behavior of TarFile.errorlevel = 0 in affected versions is that the member would still be extracted and not
- affected < 3.11.13-150600.3.30.1fixed 3.11.13-150600.3.30.1
Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extrac
- affected < 3.11.13-150600.3.30.1fixed 3.11.13-150600.3.30.1
Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extrac
- affected < 3.11.13-150600.3.30.1fixed 3.11.13-150600.3.30.1
Allows modifying some file metadata (e.g. last modified) with filter="data" or file permissions (chmod) with filter="tar" of files outside the extraction directory. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.
- affected < 3.11.13-150600.3.30.1fixed 3.11.13-150600.3.30.1
There is an issue in CPython when using `bytes.decode("unicode_escape", error="ignore|replace")`. If you are not using the "unicode_escape" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap th
Page 2 of 2