p PatchFirst

PatchFirst · Vulnérabilités récentes

Vulnérabilités de python3.8

Vulnérabilités publiées pour python3.8 au cours des 30 derniers jours : 0. Présentes dans le catalogue KEV : 0.

RSS ↗ JSON ↗
Filtrer les vulnérabilités
Effacer les filtres

Vulnérabilités : 29

  1. CVE-2025-0938

    Moyenne · CVSS 6.3EPSS 1,56%Correctif disponible

    URL parser allowed square brackets in domain names

    The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential parsing across the Python URL parser and other specification-compliant URL parsers.

    python3.8Systèmes d’exploitation
    • Mettez à jour vers 3.8.10-0ubuntu1~20.04.16
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  2. CVE-2024-11168

    Moyenne · CVSS 6.3EPSS 0,66%Correctif disponible

    Improper validation of IPv6 and IPvFuture addresses

    The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser.

    python3.8Systèmes d’exploitation
    • Mettez à jour vers 3.8.10-0ubuntu1~20.04.14
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  3. CVE-2024-9287

    Moyenne · CVSS 5.3EPSS 0,65%Correctif disponible

    Virtual environment (venv) activation scripts don't quote paths

    A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren't activated before being used (ie "./venv/bin/python") are not affected.

    python3.8Systèmes d’exploitation
    • Mettez à jour vers 3.8.10-0ubuntu1~20.04.16
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  4. CVE-2024-6232

    Élevée · CVSS 7.5EPSS 2,2%Correctif disponible

    Regular-expression DoS when parsing TarFile headers

    There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.

    python3.8Systèmes d’exploitation
    • Mettez à jour vers 3.8.10-0ubuntu1~20.04.12
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  5. CVE-2024-8088

    Élevée · CVSS 8.7EPSS 1,27%Correctif disponible

    Infinite loop when iterating over zip archive entry names from zipfile.Path

    There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class is unaffected. When iterating over names of entries in a zip archive (for example, methods of "zipfile.Path" like "namelist()", "iterdir()", etc) the process can be put into an infinite loop with a maliciously crafted zip archive. This defect applies when reading only metadata or extracting the contents of the zip archive. Programs that are not handling user-controlled zip archives are not affected.

    python3.8Systèmes d’exploitation
    • Mettez à jour vers 3.8.10-0ubuntu1~20.04.12
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  6. CVE-2024-7592

    Élevée · CVSS 7.5EPSS 2,3%Correctif disponible

    Quadratic complexity parsing cookies with backslashes

    There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used while parsing the value.

    python3.8Systèmes d’exploitation
    • Mettez à jour vers 3.8.10-0ubuntu1~20.04.12
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  7. CVE-2024-6923

    Moyenne · CVSS 5.5EPSS 1,1%Correctif disponible

    Email header injection due to unquoted newlines

    There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized.

    python3.8Systèmes d’exploitation
    • Mettez à jour vers 3.8.10-0ubuntu1~20.04.12
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  8. CVE-2024-0397

    Élevée · CVSS 7.4EPSS 0,81%Correctif disponible

    Memory race condition in ssl.SSLContext certificate store methods

    A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at the same time as certificates are loaded into the SSLContext, such as during the TLS handshake with a certificate directory configured. This issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5.

    python3.8Systèmes d’exploitation
    • Mettez à jour vers 3.8.10-0ubuntu1~20.04.11
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  9. CVE-2024-4032

    Élevée · CVSS 7.5EPSS 1,08%Correctif disponible

    Incorrect IPv4 and IPv6 private ranges

    The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the is_private and is_global properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network classes, where values wouldn’t be returned in accordance with the latest information from the IANA Special-Purpose Address Registries. CPython 3.12.4 and 3.13.0a6 contain updated information from these registries and thus have the intended behavior.

    python3.8Systèmes d’exploitation
    • Mettez à jour vers 3.8.10-0ubuntu1~20.04.11
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  10. CVE-2023-6597

    Élevée · CVSS 7.8EPSS 0,31%Correctif disponible

    CVE-2023-6597

    An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference symlinks during cleanup of permissions-related errors. This means users which can run privileged programs are potentially able to modify permissions of files referenced by symlinks in some circumstances.

    python3.8Systèmes d’exploitation
    • Mettez à jour vers 3.8.10-0ubuntu1~20.04.10
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  11. CVE-2024-0450

    Moyenne · CVSS 6.2EPSS 0,34%Correctif disponible

    Quoted zip-bomb protection for zipfile

    An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The zipfile module is vulnerable to “quoted-overlap” zip-bombs which exploit the zip format to create a zip-bomb with a high compression ratio. The fixed versions of CPython makes the zipfile module reject zip archives which overlap entries in the archive.

    python3.8Systèmes d’exploitation
    • Mettez à jour vers 3.8.10-0ubuntu1~20.04.10
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  12. CVE-2023-40217

    Moyenne · CVSS 5.3EPSS 0,8%Correctif disponible

    CVE-2023-40217

    An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If a TLS server-side socket is created, receives data into the socket buffer, and then is closed quickly, there is a brief window where the SSLSocket instance will detect the socket as "not connected" and won't initiate a handshake, but buffered data will still be readable from the socket buffer. This data will not be authenticated if the server-side TLS peer is expecting client certificate authentication, and is indistinguishable from val

    python3.8Systèmes d’exploitation
    • Mettez à jour vers 3.8.10-0ubuntu1~20.04.9
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  14. CVE-2023-27043

    Moyenne · CVSS 5.3EPSS 2,53%Correctif disponible

    CVE-2023-27043

    The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python.

    python3.8Systèmes d’exploitation
    • Mettez à jour vers 3.8.10-0ubuntu1~20.04.12
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  16. CVE-2022-45061

    Élevée · CVSS 7.5EPSS 2,67%Correctif disponible

    CVE-2022-45061

    An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3

    python3.8Systèmes d’exploitation
    • Mettez à jour vers 3.8.10-0ubuntu1~20.04.6
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  17. CVE-2022-37454

    Critique · CVSS 9.8EPSS 7,41%Correctif disponible

    CVE-2022-37454

    The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.

    python3.8Systèmes d’exploitation
    • Mettez à jour vers 3.8.10-0ubuntu1~20.04.6
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  18. CVE-2015-20107

    Élevée · CVSS 7.8EPSS 2,78%Correctif disponible

    CVE-2015-20107

    In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9

    python3.8Systèmes d’exploitation
    • Mettez à jour vers 3.8.10-0ubuntu1~20.04.5
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  19. CVE-2021-3733

    Moyenne · CVSS 6.5EPSS 4,8%Correctif disponible

    CVE-2021-3733

    There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.

    python3.8Systèmes d’exploitation
    • Mettez à jour vers 3.8.10-0ubuntu1~20.04
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  20. CVE-2021-3737

    Élevée · CVSS 7.5EPSS 13,17%Correctif disponible

    CVE-2021-3737

    A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability.

    python3.8Systèmes d’exploitation
    • Mettez à jour vers 3.8.10-0ubuntu1~20.04.2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

Vérifiez votre serveur

Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.

Vérifiez votre serveur →