p PatchFirst

PatchFirst · Vulnérabilités récentes

Vulnérabilités de python2.7

Vulnérabilités publiées pour python2.7 au cours des 30 derniers jours : 0. Présentes dans le catalogue KEV : 0.

RSS ↗ JSON ↗
Filtrer les vulnérabilités
Effacer les filtres

Vulnérabilités : 14

  1. USN-7015-6

    Non évaluéeCorrectif disponible

    python2.7 regresssions

    USN-7015-5 fixed vulnerabilities in python2.7. The update introduced several minor regressions. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that the Python email module incorrectly parsed email addresses that contain special characters. A remote attacker could possibly use this issue to bypass certain protection mechanisms. (CVE-2023-27043) It was discovered that Python allowed excessive backtracking while parsing certain tarfile headers. A remote attacker could possibly use this issue to cause Python to consume resources, leading to a denial of service. (CVE-202

    python2.7Systèmes d’exploitation
    • Mettez à jour vers 2.7.18-1~20.04.6
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  2. CVE-2024-6232

    Élevée · CVSS 7.5EPSS 2,2%Correctif disponible

    Regular-expression DoS when parsing TarFile headers

    There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.

    python2.7Systèmes d’exploitation
    • Mettez à jour vers 2.7.18-1~20.04.5
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  3. CVE-2024-6923

    Moyenne · CVSS 5.5EPSS 1,1%Correctif disponible

    Email header injection due to unquoted newlines

    There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized.

    python2.7Systèmes d’exploitation
    • Mettez à jour vers 2.7.18-1~20.04.5
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  4. CVE-2023-40217

    Moyenne · CVSS 5.3EPSS 0,8%Correctif disponible

    CVE-2023-40217

    An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If a TLS server-side socket is created, receives data into the socket buffer, and then is closed quickly, there is a brief window where the SSLSocket instance will detect the socket as "not connected" and won't initiate a handshake, but buffered data will still be readable from the socket buffer. This data will not be authenticated if the server-side TLS peer is expecting client certificate authentication, and is indistinguishable from val

    python2.7Systèmes d’exploitation
    • Mettez à jour vers 2.7.18-1~20.04.7
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  9. CVE-2015-20107

    Élevée · CVSS 7.8EPSS 2,78%Correctif disponible

    CVE-2015-20107

    In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9

    python2.7Systèmes d’exploitation
    • Mettez à jour vers 2.7.18-1~20.04.3
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  10. CVE-2021-3177

    Critique · CVSS 9.8EPSS 24,22%Correctif disponible

    CVE-2021-3177

    Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.

    python2.7Systèmes d’exploitation
    • Mettez à jour vers 2.7.18-1~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  13. CVE-2020-8492

    Moyenne · CVSS 6.5EPSS 6,62%Correctif disponible

    CVE-2020-8492

    Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.

    python2.7Systèmes d’exploitation
    • Mettez à jour vers 2.7.18-1~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  14. CVE-2019-17514

    Élevée · CVSS 7.5EPSS 4,67%Correctif disponible

    CVE-2019-17514

    library/glob.html in the Python 2 and 3 documentation before 2016 has potentially misleading information about whether sorting occurs, as demonstrated by irreproducible cancer-research results. NOTE: the effects of this documentation cross application domains, and thus it is likely that security-relevant code elsewhere is affected. This issue is not a Python implementation bug, and there are no reports that NMR researchers were specifically relying on library/glob.html. In other words, because the older documentation stated "finds all the pathnames matching a specified pattern according to the rules used by the Unix shell," one might have inc

    python2.7Systèmes d’exploitation
    • Mettez à jour vers 2.7.18-1~20.04.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

Vérifiez votre serveur

Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.

Vérifiez votre serveur →