rpm package
suse/saltbundlepy-zipp&distro=SUSE:EL-9:Update:Products:SaltBundle:Update
pkg:rpm/suse/saltbundlepy-zipp&distro=SUSE:EL-9:Update:Products:SaltBundle:Update
Vulnerabilities (9)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2024-8088 | Hig | — | < 3.15.0-1.9.2 | 3.15.0-1.9.2 | Aug 22, 2024 | There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class is unaffected. When iterating over names of entries in a zip archive (for example, methods of "zipfile.Path" like "na | |
| CVE-2024-7592 | — | < 3.15.0-1.9.2 | 3.15.0-1.9.2 | Aug 19, 2024 | There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in | ||
| CVE-2024-6923 | Med | 5.5 | < 3.15.0-1.9.2 | 3.15.0-1.9.2 | Aug 1, 2024 | There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized. | |
| CVE-2024-6345 | Hig | 8.8 | < 3.15.0-1.9.2 | 3.15.0-1.9.2 | Jul 15, 2024 | A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are suscepti | |
| CVE-2024-5569 | Med | 6.2 | < 3.15.0-1.9.2 | 3.15.0-1.9.2 | Jul 9, 2024 | A Denial of Service (DoS) vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile module of CPython, as | |
| CVE-2024-3651 | — | < 3.15.0-1.9.2 | 3.15.0-1.9.2 | Jul 7, 2024 | A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service co | ||
| CVE-2024-37891 | — | < 3.15.0-1.9.2 | 3.15.0-1.9.2 | Jun 17, 2024 | urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected. However, when sending HTTP requests *without* using urllib3's proxy support, it' | ||
| CVE-2024-0397 | Hig | 7.4 | < 3.15.0-1.9.2 | 3.15.0-1.9.2 | Jun 17, 2024 | A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at the same time as certificates are loaded into the | |
| CVE-2024-4032 | Hig | 7.5 | < 3.15.0-1.9.2 | 3.15.0-1.9.2 | Jun 17, 2024 | The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the is_private and is_global properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Addr |
- affected < 3.15.0-1.9.2fixed 3.15.0-1.9.2
There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class is unaffected. When iterating over names of entries in a zip archive (for example, methods of "zipfile.Path" like "na
- CVE-2024-7592Aug 19, 2024affected < 3.15.0-1.9.2fixed 3.15.0-1.9.2
There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in
- affected < 3.15.0-1.9.2fixed 3.15.0-1.9.2
There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized.
- affected < 3.15.0-1.9.2fixed 3.15.0-1.9.2
A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are suscepti
- affected < 3.15.0-1.9.2fixed 3.15.0-1.9.2
A Denial of Service (DoS) vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile module of CPython, as
- CVE-2024-3651Jul 7, 2024affected < 3.15.0-1.9.2fixed 3.15.0-1.9.2
A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service co
- CVE-2024-37891Jun 17, 2024affected < 3.15.0-1.9.2fixed 3.15.0-1.9.2
urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected. However, when sending HTTP requests *without* using urllib3's proxy support, it'
- affected < 3.15.0-1.9.2fixed 3.15.0-1.9.2
A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at the same time as certificates are loaded into the
- affected < 3.15.0-1.9.2fixed 3.15.0-1.9.2
The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the is_private and is_global properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Addr