Schwachstellen im Stack Python · Seite 134

sigstore has CSRF possibility in OIDC authentication during signing

sigstore-python is a Python tool for generating and verifying Sigstore signatures. Prior to version 4.2.0, the sigstore-python OAuth authentication flow is susceptible to Cross-Site Request Forgery. `_OAuthSession` creates a unique "state" and sends it as a parameter in the authentication request but the "state" in the server response seems not not be cross-checked with this value. Version 4.2.0 contains a patch for the issue.

• Auf 4.2.0 aktualisieren

BentoML has a Path Traversal via Bentofile Configuration

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to version 1.4.34, BentoML's `bentofile.yaml` configuration allows path traversal attacks through multiple file path fields (`description`, `docker.setup_script`, `docker.dockerfile_template`, `conda.environment_yml`). An attacker can craft a malicious bentofile that, when built by a victim, exfiltrates arbitrary files from the filesystem into the bento archive. This enables supply chain attacks where sensitive files (SSH keys, credentials, environment variables) are silently embedded in bentos and exposed when pushed to registries

• Auf 1.4.34 aktualisieren

dcap-qvl has Missing Verification for QE Identity

dcap-qvl implements the quote verification logic for DCAP (Data Center Attestation Primitives). A vulnerability present in versions prior to 0.3.9 involves a critical gap in the cryptographic verification process within the dcap-qvl. The library fetches QE Identity collateral (including qe_identity, qe_identity_signature, and qe_identity_issuer_chain) from the PCCS. However, it skips to verify the QE Identity signature against its certificate chain and does not enforce policy constraints on the QE Report. An attacker can forge the QE Identity data to whitelist a malicious or non-Intel Quoting Enclave. This allows the attacker to forge the QE

• Auf 0.3.9 aktualisieren

Gi-docgen: reflected dom xss in gi-docgen

A flaw was found in the gi-docgen. This vulnerability allows arbitrary JavaScript execution in the context of the page — enabling DOM access, session cookie theft and other client-side attacks — via a crafted URL that supplies a malicious value to the q GET parameter (reflected DOM XSS).

• Auf 2025.5 aktualisieren
• Auf 2025.5-1 aktualisieren

email BytesGenerator header injection due to unquoted newlines

The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized. This is only applicable if using "LiteralHeader" writing headers that don't respect email folding rules, the new behavior will reject the incorrectly folded headers in "BytesGenerator".

• Auf 3.10.20 aktualisieren
• Auf 3.11.15 aktualisieren
• Auf 3.11.2-6+deb12u7 aktualisieren
• Auf 3.12.13 aktualisieren
• Auf 3.13.12 aktualisieren
• Auf 3.13.5-2+deb13u1 aktualisieren
• Auf 3.14.3 aktualisieren
• Auf 3.14.3-1 aktualisieren
• Auf 3.15.0a6 aktualisieren
• Auf 7.3.21+dfsg-1 aktualisieren

Denial of Service in Python Protobuf

A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.

• Auf 3.0.0-9.1ubuntu1.1+esm4 aktualisieren
• Auf 3.12.4-1ubuntu7.22.04.6 aktualisieren
• Auf 3.21.12-11+deb13u1 aktualisieren
• Auf 3.21.12-11ubuntu3.1 aktualisieren
• Auf 3.21.12-15ubuntu1 aktualisieren
• Auf 3.21.12-16 aktualisieren
• Auf 3.21.12-3+deb12u1 aktualisieren
• Auf 3.21.12-8.2ubuntu0.3 aktualisieren
• Auf 3.6.1.3-2ubuntu5.2+esm3 aktualisieren
• Auf 5.29.6 aktualisieren
• Auf 6.33.5 aktualisieren

Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability

Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the exec_globals parameter provided to the validate endpoint. The issue results from the inclusion of a resource from an untrusted control sphere. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-27325.

Moonraker with LDAP Enabled Allows Malicious Search Filter Injection

Moonraker is a Python web server providing API access to Klipper 3D printing firmware. In versions 0.9.3 and below, instances configured with the "ldap" component enabled are vulnerable to LDAP search filter injection techniques via the login endpoint. The 401 error response message can be used to determine whether or not a search was successful, allowing for brute force methods to discover LDAP entries on the server such as user IDs and user attributes. This issue has been fixed in version 0.10.0.

• Auf 0.10.0 aktualisieren

Invalid Memory Access in Sentencepiece,

Invalid memory access in Sentencepiece versions less than 0.2.1 when using a vulnerable model file, which is not created in the normal training procedure.

• Auf 0.2.1 aktualisieren

Docling Core vulnerable to Remote Code Execution via unsafe PyYAML usage

Docling Core (or docling-core) is a library that defines core data types and transformations in the document processing application Docling. A PyYAML-related Remote Code Execution (RCE) vulnerability, namely CVE-2020-14343, is exposed in docling-core starting in version 2.21.0 and prior to version 2.48.4, specifically only if the application uses pyyaml prior to version 5.4 and invokes `docling_core.types.doc.DoclingDocument.load_from_yaml()` passing it untrusted YAML data. The vulnerability has been patched in docling-core version 2.48.4. The fix mitigates the issue by switching `PyYAML` deserialization from `yaml.FullLoader` to `yaml.SafeLo

• Auf 2.48.4 aktualisieren

CVE-2025-71176

pytest through 9.0.2 on UNIX relies on directories with the /tmp/pytest-of-{user} name pattern, which allows local users to cause a denial of service or possibly gain privileges.

• Auf 9.0.3 aktualisieren

wheel Allows Arbitrary File Permission Modification via Path Traversal

wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack function is vulnerable to file permission modification through mishandling of file permissions after extraction. The logic blindly trusts the filename from the archive header for the chmod operation, even though the extraction process itself might have sanitized the path. Attackers can craft a malicious wheel file that, when unpacked, changes the permissions of critical system files (e.g., /etc/passwd, SSH keys, config files), allowing for Privilege Escalation or arbitrary code execution by modifying now-writa

• Auf 0.42.0-2ubuntu0.1~esm1 aktualisieren
• Auf 0.46.2 aktualisieren
• Auf 0.46.3-1 aktualisieren

Tendenci has Authenticated Remote Code Execution via Pickle Deserialization

Tendenci is an open source content management system built for non-profits, associations and cause-based sites. Versions 15.3.11 and below include a critical deserialization vulnerability in the Helpdesk module (which is not enabled by default). This vulnerability allows Remote Code Execution (RCE) by an authenticated user with staff security level due to using Python's pickle module in helpdesk /reports/. The original CVE-2020-14942 was incompletely patched. While ticket_list() was fixed to use safe JSON deserialization, the run_report() function still uses unsafe pickle.loads(). The impact is limited to the permissions of the user running t

• Auf 15.3.12 aktualisieren

CVE-2025-67221

The orjson.dumps function in orjson thru 3.11.4 does not limit recursion for deeply nested JSON documents.

• Auf 3.11.5 aktualisieren
• Auf 3.11.6 aktualisieren

FastAPI Api Key has a timing side-channel in verify_key that allows statistical key validity detection

FastAPI Api Key provides a backend-agnostic library that provides an API key system. Version 1.1.0 has a timing side-channel vulnerability in verify_key(). The method applied a random delay only on verification failures, allowing an attacker to statistically distinguish valid from invalid API keys by measuring response latencies. With enough repeated requests, an adversary could infer whether a key_id corresponds to a valid key, potentially accelerating brute-force or enumeration attacks. All users relying on verify_key() for API key authentication prior to the fix are affected. Users should upgrade to version 1.1.0 to receive a patch. The pa

• Auf 1.1.0 aktualisieren

Copier safe template has arbitrary filesystem write access via directory symlinks when _preserve_symlinks: true

Copier is a library and CLI app for rendering project templates. Prior to version 9.11.2, Copier suggests that it's safe to generate a project from a safe template, i.e. one that doesn't use unsafe features like custom Jinja extensions which would require passing the `--UNSAFE,--trust` flag. As it turns out, a safe template can currently write to arbitrary directories outside the destination path by using directory a symlink along with `_preserve_symlinks: true` and a generated directory structure whose rendered path is inside the symlinked directory. This way, a malicious template author can create a template that overwrites arbitrary files

• Auf 9.11.2 aktualisieren

Copier safe template has arbitrary filesystem read access via symlinks when _preserve_symlinks: false

Copier is a library and CLI app for rendering project templates. Prior to version 9.11.2, Copier suggests that it's safe to generate a project from a safe template, i.e. one that doesn't use unsafe features like custom Jinja extensions which would require passing the `--UNSAFE,--trust` flag. As it turns out, a safe template can currently include arbitrary files/directories outside the local template clone location by using symlinks along with `_preserve_symlinks: false` (which is Copier's default setting). Version 9.11.2 patches the issue.

• Auf 9.11.2 aktualisieren

vLLM affected by RCE via auto_map dynamic module loading during model initialization

vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.14.0, vLLM loads Hugging Face `auto_map` dynamic modules during model resolution without gating on `trust_remote_code`, allowing attacker-controlled Python code in a model repo/path to execute at server startup. An attacker who can influence the model repo/path (local directory or remote Hugging Face repo) can achieve arbitrary code execution on the vLLM host during model load. This happens before any request handling and does not require API access. Version 0.14.0 fixes the issue.

• Auf 0.14.0 aktualisieren

base64.b64decode() always accepts "+/" characters, despite setting altchars

When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be accepted, regardless of the value of "altchars" parameter, typically used to establish an "alternative base64 alphabet" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues. This behavior can only be insecure if your application uses an alternate base64 alphabet (w

• Auf 3.13.10 aktualisieren
• Auf 3.14.1 aktualisieren
• Auf 3.14.2-1 aktualisieren
• Auf 3.15.0a2 aktualisieren

Header injection in http.cookies.Morsel

When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.

• Auf 2.7.12-1ubuntu0~16.04.18+esm19 aktualisieren
• Auf 2.7.17-1~18.04ubuntu1.13+esm14 aktualisieren
• Auf 2.7.6-8ubuntu0.6+esm29 aktualisieren
• Auf 3.10.12-1~22.04.14 aktualisieren
• Auf 3.10.20 aktualisieren
• Auf 3.11.15 aktualisieren
• Auf 3.11.2-6+deb12u7 aktualisieren
• Auf 3.12.13 aktualisieren
• Auf 3.13.12 aktualisieren
• Auf 3.13.5-2+deb13u1 aktualisieren
• Auf 3.14.3 aktualisieren
• Auf 3.14.3-1 aktualisieren
• Auf 3.15.0a6 aktualisieren
• Auf 3.4.3-1ubuntu1~14.04.7+esm19 aktualisieren
• Auf 3.5.2-2ubuntu0~16.04.13+esm21 aktualisieren
• Auf 3.5.2-2ubuntu0~16.04.4~14.04.1+esm9 aktualisieren
• Auf 3.6.9-1~18.04ubuntu1.13+esm8 aktualisieren
• Auf 3.7.5-2ubuntu1~18.04.2+esm9 aktualisieren
• Auf 3.8.0-3ubuntu1~18.04.2+esm9 aktualisieren
• Auf 3.8.10-0ubuntu1~20.04.18+esm5 aktualisieren
• Auf 3.9.5-3ubuntu0~20.04.1+esm9 aktualisieren
• Auf 7.3.21+dfsg-1 aktualisieren