p PatchFirst

PatchFirst · Vulnérabilités récentes

Vulnérabilités de python3.11 · Page n° 4

Vulnérabilités publiées pour python3.11 au cours des 30 derniers jours : 4. Présentes dans le catalogue KEV : 0.

RSS ↗
Filtrer les vulnérabilités
Effacer les filtres

Vulnérabilités : 66

  1. CVE-2023-27043

    Moyenne · CVSS 5.3EPSS 2,53%Correctif disponible

    CVE-2023-27043

    The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python.

    python3.11Systèmes d’exploitation
    • Mettez à jour vers 3.11.2-6+deb12u5
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  3. CVE-2022-45061

    Élevée · CVSS 7.5EPSS 2,67%Correctif disponible

    CVE-2022-45061

    An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3

    python3.11Systèmes d’exploitation
    • Mettez à jour vers 3.11.1-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  4. CVE-2022-42919

    Élevée · CVSS 7.8EPSS 0,76%Correctif disponible

    CVE-2022-42919

    Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non-default configuration. The Python multiprocessing library, when used with the forkserver start method on Linux, allows pickles to be deserialized from any user in the same machine local network namespace, which in many system configurations means any user on the same machine. Pickles can execute arbitrary code. Thus, this allows for local user privilege escalation to the user that any forkserver process is running as. Setting multiprocessing.util.abstract_sockets_supported to False is a workaround. The forkserver start method for multiproce

    python3.11Systèmes d’exploitation
    • Mettez à jour vers 3.11.0-2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  5. CVE-2020-10735

    Moyenne · CVSS 6.2EPSS 4,49%Correctif disponible

    CVE-2020-10735

    A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability.

    python3.11Systèmes d’exploitation
    • Mettez à jour vers 3.11.0~rc2-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  6. CVE-2021-28861

    Moyenne · CVSS 6.5EPSS 2,71%Correctif disponible

    CVE-2021-28861

    Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states "Warning: http.server is not recommended for production. It only implements basic security checks."

    python3.11Systèmes d’exploitation
    • Mettez à jour vers 3.11.0~b4-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

Vérifiez votre serveur

Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.

Vérifiez votre serveur →