{"kind": "product", "path": "vulns/ubuntu-16.04-lts/python2.7", "name": "python2.7", "product": "python2.7", "ecosystem": "Ubuntu:16.04:LTS", "items": [{"id": "USN-4754-2", "noindex": true, "published": "2021-02-25T18:54:00Z", "modified": "2026-06-29T13:48:10.272463037Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/usn-4754-2", "title": "python2.7 regression", "description": "USN-4754-1 fixed a vulnerability in Python. The fix for CVE-2021-3177 introduced a\nregression in Python 2.7. This update reverts the security fix pending further investigation.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n It was discovered that Python incorrectly handled certain inputs.\n An attacker could possibly use this issue to execute arbitrary code\n or cause a denial of service. (CVE-2020-27619, CVE-2021-3177)\n", "references": ["https://ubuntu.com/security/notices/USN-4754-2", "https://launchpad.net/bugs/1916893", "https://osv.dev/vulnerability/USN-4754-2"], "fixes": ["2.7.12-1ubuntu0~16.04.16"], "products": [{"name": "python2.7", "path": "vulns/ubuntu-16.04-lts/python2.7", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2021-3177", "noindex": false, "published": "2021-01-19T00:00:00.000Z", "modified": "2026-10-14T09:45:04.275Z", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "critical", "epss": 0.24216, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2021-3177", "title": "CVE-2021-3177", "description": "Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.", "references": ["https://bugs.python.org/issue42938", "https://github.com/python/cpython/pull/24239", "https://python-security.readthedocs.io/vuln/ctypes-buffer-overflow-pycarg_repr.html"], "fixes": ["2.7.12-1ubuntu0~16.04.18"], "products": [{"name": "python2.7", "path": "vulns/ubuntu-16.04-lts/python2.7", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2019-20907", "noindex": false, "published": "2020-07-13T00:00:00.000Z", "modified": "2026-10-14T07:57:15.074Z", "cvss": 5.5, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.02985, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2019-20907", "title": "CVE-2019-20907", "description": "In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.", "references": ["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VT4AF72TJ2XNIKCR4WEBR7URBJJ4YZRD/", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CAXHCY4V3LPAAJOBCJ26ISZ4NUXQXTUZ/", "https://usn.ubuntu.com/4428-1/"], "fixes": ["2.7.12-1ubuntu0~16.04.12"], "products": [{"name": "python2.7", "path": "vulns/ubuntu-16.04-lts/python2.7", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2019-9674", "noindex": false, "published": "2020-02-04T14:05:49.000Z", "modified": "2026-10-14T06:49:41.485Z", "cvss": 7.5, "cvss_vector": "", "severity": "high", "epss": 0.05636, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2019-9674", "title": "CVE-2019-9674", "description": "Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb.", "references": ["https://www.python.org/news/security/", "https://github.com/python/cpython/blob/master/Lib/zipfile.py", "https://bugs.python.org/issue36462"], "fixes": ["2.7.12-1ubuntu0~16.04.12"], "products": [{"name": "python2.7", "path": "vulns/ubuntu-16.04-lts/python2.7", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2020-8492", "noindex": false, "published": "2020-01-30T00:00:00.000Z", "modified": "2026-10-14T08:40:24.670Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.06617, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2020-8492", "title": "CVE-2020-8492", "description": "Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.", "references": ["https://bugs.python.org/issue39503", "https://python-security.readthedocs.io/vuln/urllib-basic-auth-regex.html", "https://github.com/python/cpython/pull/18284"], "fixes": ["2.7.12-1ubuntu0~16.04.11"], "products": [{"name": "python2.7", "path": "vulns/ubuntu-16.04-lts/python2.7", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2016-1000110", "noindex": false, "published": "2019-11-27T16:54:34.000Z", "modified": "2024-08-06T03:55:26.422Z", "cvss": 6.1, "cvss_vector": "", "severity": "medium", "epss": 0.04526, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2016-1000110", "title": "CVE-2016-1000110", "description": "The CGIHandler class in Python before 2.7.12 does not protect against the HTTP_PROXY variable name clash in a CGI script, which could allow a remote attacker to redirect HTTP requests.", "references": ["https://security-tracker.debian.org/tracker/CVE-2016-1000110", "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1000110", "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2016-1000110"], "fixes": ["2.7.12-1ubuntu0~16.04.1"], "products": [{"name": "python2.7", "path": "vulns/ubuntu-16.04-lts/python2.7", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2019-5010", "noindex": false, "published": "2019-10-31T20:05:57.000Z", "modified": "2026-10-07T18:55:25.413Z", "cvss": 5.9, "cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.20743, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2019-5010", "title": "CVE-2019-5010", "description": "An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability.", "references": ["https://access.redhat.com/errata/RHSA-2019:3520", "https://access.redhat.com/errata/RHSA-2019:3725", "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html"], "fixes": ["2.7.12-1ubuntu0~16.04.8"], "products": [{"name": "python2.7", "path": "vulns/ubuntu-16.04-lts/python2.7", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2019-18348", "noindex": false, "published": "2019-10-23T16:31:22.000Z", "modified": "2026-10-14T06:54:53.676Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.03513, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2019-18348", "title": "CVE-2019-18348", "description": "An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the host component of a URL) followed by an HTTP header. This is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947 path string issue. (This is not exploitable when glibc has CVE-2016-10739 fixed.). This is fixed in: v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1; v3.6.11, v3.6.11rc1, v3.6.12; v3.7.8, v3.7.8rc1, v3.7.9; v3.8.3, v3.8.3rc1, v3.8.4, v3.8.4rc1, v3.8.5, v3.8.", "references": ["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/"], "fixes": ["2.7.12-1ubuntu0~16.04.11"], "products": [{"name": "python2.7", "path": "vulns/ubuntu-16.04-lts/python2.7", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2019-17514", "noindex": false, "published": "2019-10-12T12:07:23.000Z", "modified": "2024-08-05T01:40:15.920Z", "cvss": 7.5, "cvss_vector": "", "severity": "high", "epss": 0.04671, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2019-17514", "title": "CVE-2019-17514", "description": "library/glob.html in the Python 2 and 3 documentation before 2016 has potentially misleading information about whether sorting occurs, as demonstrated by irreproducible cancer-research results. NOTE: the effects of this documentation cross application domains, and thus it is likely that security-relevant code elsewhere is affected. This issue is not a Python implementation bug, and there are no reports that NMR researchers were specifically relying on library/glob.html. In other words, because the older documentation stated \"finds all the pathnames matching a specified pattern according to the rules used by the Unix shell,\" one might have inc", "references": ["https://web.archive.org/web/20150906020027/https://docs.python.org/2.7/library/glob.html", "https://web.archive.org/web/20160526201356/https://docs.python.org/2.7/library/glob.html", "https://web.archive.org/web/20150822013622/https://docs.python.org/3/library/glob.html"], "fixes": ["2.7.12-1ubuntu0~16.04.12"], "products": [{"name": "python2.7", "path": "vulns/ubuntu-16.04-lts/python2.7", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2019-16935", "noindex": false, "published": "2019-09-28T01:33:02.000Z", "modified": "2026-10-07T18:18:30.322Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.04653, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2019-16935", "title": "CVE-2019-16935", "description": "The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary JavaScript can be delivered to clients that visit the http URL for this server.", "references": ["https://usn.ubuntu.com/4151-1/", "https://usn.ubuntu.com/4151-2/", "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00062.html"], "fixes": ["2.7.12-1ubuntu0~16.04.9"], "products": [{"name": "python2.7", "path": "vulns/ubuntu-16.04-lts/python2.7", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2019-16056", "noindex": false, "published": "2019-09-06T17:24:35.000Z", "modified": "2026-10-14T06:50:11.813Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "medium", "epss": 0.0512, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2019-16056", "title": "CVE-2019-16056", "description": "An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally.", "references": ["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K4KZEFP6E4YPYB52AF4WXCUDSGQOTF37/", "https://lists.debian.org/debian-lts-announce/2019/09/msg00019.html", "https://lists.debian.org/debian-lts-announce/2019/09/msg00018.html"], "fixes": ["2.7.12-1ubuntu0~16.04.9"], "products": [{"name": "python2.7", "path": "vulns/ubuntu-16.04-lts/python2.7", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2018-20852", "noindex": false, "published": "2019-07-13T20:29:42.000Z", "modified": "2026-10-07T18:24:46.612Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.03668, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2018-20852", "title": "CVE-2018-20852", "description": "http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this flaw by using a server with a hostname that has another valid hostname as a suffix (e.g., pythonicexample.com to steal cookies for example.com). When a program uses http.cookiejar.DefaultPolicy and tries to do an HTTP connection to an attacker-controlled server, existing cookies can be leaked to the attacker. This affects 2.x through 2.7.16, 3.x before 3.4.10, 3.5.x before 3.5.7, 3.6.x before 3.6.9, and 3.7.x before ", "references": ["https://bugs.python.org/issue35121", "https://python-security.readthedocs.io/vuln/cookie-domain-check.html", "https://lists.debian.org/debian-lts-announce/2019/08/msg00022.html"], "fixes": ["2.7.12-1ubuntu0~16.04.8"], "products": [{"name": "python2.7", "path": "vulns/ubuntu-16.04-lts/python2.7", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2019-10160", "noindex": false, "published": "2019-06-07T17:50:33.000Z", "modified": "2026-10-14T06:49:52.193Z", "cvss": 9.8, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "critical", "epss": 0.05227, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2019-10160", "title": "CVE-2019-10160", "description": "A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs", "references": ["https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization2.html", "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10160", "https://github.com/python/cpython/commit/8d0ef0b5edeae52960c7ed05ae8a12388324f87e"], "fixes": ["2.7.12-1ubuntu0~16.04.8"], "products": [{"name": "python2.7", "path": "vulns/ubuntu-16.04-lts/python2.7", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2019-9948", "noindex": false, "published": "2019-03-23T17:07:08.000Z", "modified": "2026-10-14T06:49:50.648Z", "cvss": 9.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "critical", "epss": 0.11844, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2019-9948", "title": "CVE-2019-9948", "description": "urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.", "references": ["https://bugs.python.org/issue35907", "https://github.com/python/cpython/pull/11842", "http://www.securityfocus.com/bid/107549"], "fixes": ["2.7.12-1ubuntu0~16.04.8"], "products": [{"name": "python2.7", "path": "vulns/ubuntu-16.04-lts/python2.7", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2019-9947", "noindex": false, "published": "2019-03-23T17:06:47.000Z", "modified": "2026-10-14T06:49:49.072Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.05253, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2019-9947", "title": "CVE-2019-9947", "description": "An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v", "references": ["https://bugs.python.org/issue35906", "https://security.netapp.com/advisory/ntap-20190404-0004/", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/"], "fixes": ["2.7.12-1ubuntu0~16.04.8"], "products": [{"name": "python2.7", "path": "vulns/ubuntu-16.04-lts/python2.7", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2019-9740", "noindex": false, "published": "2019-03-13T03:00:00.000Z", "modified": "2026-10-14T06:49:42.941Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.05408, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2019-9740", "title": "CVE-2019-9740", "description": "An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9", "references": ["http://www.securityfocus.com/bid/107466", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/", "https://access.redhat.com/errata/RHSA-2019:1260"], "fixes": ["2.7.12-1ubuntu0~16.04.8"], "products": [{"name": "python2.7", "path": "vulns/ubuntu-16.04-lts/python2.7", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2019-9636", "noindex": false, "published": "2019-03-08T21:00:00.000Z", "modified": "2026-10-14T06:49:39.823Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.07673, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2019-9636", "title": "CVE-2019-9636", "description": "Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v", "references": ["http://www.securityfocus.com/bid/107400", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L25RTMKCF62DLC2XVSNXGX7C7HXISLVM/", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/"], "fixes": ["2.7.12-1ubuntu0~16.04.8"], "products": [{"name": "python2.7", "path": "vulns/ubuntu-16.04-lts/python2.7", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2018-14647", "noindex": false, "published": "2018-09-25T00:00:00.000Z", "modified": "2026-10-07T18:29:03.175Z", "cvss": 5.3, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": 0.10911, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2018-14647", "title": "CVE-2018-14647", "description": "Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15.", "references": ["https://www.debian.org/security/2018/dsa-4306", "https://usn.ubuntu.com/3817-2/", "http://www.securitytracker.com/id/1041740"], "fixes": ["2.7.12-1ubuntu0~16.04.4"], "products": [{"name": "python2.7", "path": "vulns/ubuntu-16.04-lts/python2.7", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2018-1000802", "noindex": false, "published": "2018-09-18T00:00:00.000Z", "modified": "2026-10-08T21:03:31.390Z", "cvss": 9.8, "cvss_vector": "", "severity": "critical", "epss": 0.20126, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2018-1000802", "title": "CVE-2018-1000802", "description": "Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace.", "references": ["https://www.debian.org/security/2018/dsa-4306", "https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html", "https://usn.ubuntu.com/3817-2/"], "fixes": ["2.7.12-1ubuntu0~16.04.4"], "products": [{"name": "python2.7", "path": "vulns/ubuntu-16.04-lts/python2.7", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2018-1061", "noindex": false, "published": "2018-06-19T12:00:00.000Z", "modified": "2026-10-15T17:20:16.677Z", "cvss": 6.5, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.04916, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2018-1061", "title": "CVE-2018-1061", "description": "python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK method.  An attacker could use this flaw to cause denial of service.", "references": ["https://www.debian.org/security/2018/dsa-4306", "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1061", "http://www.securitytracker.com/id/1042001"], "fixes": ["2.7.12-1ubuntu0~16.04.4"], "products": [{"name": "python2.7", "path": "vulns/ubuntu-16.04-lts/python2.7", "ecosystem": "Ubuntu:16.04:LTS"}]}], "total": 25, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 2, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "python2.7", "path": "vulns/ubuntu-16.04-lts/python2.7", "ecosystem": "Ubuntu:16.04:LTS"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-10-15T17:20:16.677Z", "early_advisories": [], "license": "Sie dürfen die Auswahl von PatchFirst und unsere Ergänzungen (Prioritäten, Frühwarnungen, Texte, Zusammenfassungen und Aggregate) für eigene Zwecke einschließlich interner geschäftlicher Aufgaben frei nutzen. Weiterverkauf, kommerzielle Verbreitung und massenhafte Spiegelung dieser Auswahl oder Ergänzungen erfordern eine schriftliche Vereinbarung mit dem Betreiber. Nennen Sie bei jeder Nutzung oder Veröffentlichung der Auswahl oder unserer Ergänzungen PatchFirst (https://patchfirst.dev/vulns/) mit diesem Link zur Feedseite Ihrer Region als Quelle. Originaleinträge aus offenen Quellen unterliegen weiterhin ihren jeweiligen Lizenzen und Bedingungen. Diese Bedingungen beschränken Ihre Rechte an den Originaldaten nicht, die Sie direkt bei den Quellen beziehen können.", "terms_url": "https://patchfirst.dev/de/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst wählt Einträge aus, normalisiert und kombiniert sie; Zusammenfassungen und Übersetzungen können hinzukommen. Nachrichten werden im jeweiligen Eintrag mit einem Link zur Originalquelle belegt.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Die Lizenzen der Ursprungsdatenbanken unterscheiden sich; siehe Quellenkatalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Frei zugängliche Bewertungen; Quellenangabe erbeten (FIRST EPSS, Bewertungen von Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}