python vulnerabilities · Page 3

POP3 command injection in user-controlled commands

The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.

IMAP command injection in user-controlled commands

The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.

• Update to 3.13.15
• Update to 3.14.7

Header injection via newlines in data URL mediatype

User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.

• Update to 3.10.20
• Update to 3.11.15
• Update to 3.12.13
• Update to 3.13.12
• Update to 3.14.3

wsgiref.headers.Headers allows header newline injection

User-controlled header names and values containing newlines can allow injecting HTTP headers.

• Update to 3.10.20
• Update to 3.11.15
• Update to 3.12.13
• Update to 3.13.12
• Update to 3.14.3

Folding email comments of unfoldable characters doesn't preserve parenthesis

When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized.

• Update to 3.10.20
• Update to 3.11.15
• Update to 3.12.13
• Update to 3.13.12
• Update to 3.14.3

Quadratic complexity in node ID cache clearing

When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.

• Update to 3.10.20
• Update to 3.11.15
• Update to 3.12.13
• Update to 3.13.11
• Update to 3.14.2

Out-of-memory when loading Plist

When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues

• Update to 3.10.20
• Update to 3.11.15
• Update to 3.12.13
• Update to 3.13.10
• Update to 3.14.1

Excessive read buffering DoS in http.client

When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.

• Update to 3.10.20
• Update to 3.11.15
• Update to 3.12.13
• Update to 3.13.11
• Update to 3.14.1

Quadratic complexity in os.path.expandvars() with user-controlled template

If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.

• Update to 3.10.20
• Update to 3.11.15
• Update to 3.12.13
• Update to 3.13.10
• Update to 3.14.1
• Update to 3.9.25

ZIP64 End of Central Directory (EOCD) Locator record offset not checked

The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be assumed to be the previous record in the ZIP archive. This could be abused to create ZIP archives that are handled differently by the 'zipfile' module compared to other ZIP implementations. Remediation maintains this behavior, but checks that the offset specified in the ZIP64 EOCD Locator record matches the expected value.

• Update to 3.10.19
• Update to 3.11.14
• Update to 3.12.12
• Update to 3.13.10
• Update to 3.14.1
• Update to 3.9.24

Tarfile infinite loop during parsing with negative member offset

There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives. This vulnerability can be mitigated by including the following patch after importing the “tarfile” module:  https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1

• Update to 3.10.19
• Update to 3.11.14
• Update to 3.12.12
• Update to 3.13.6
• Update to 3.14.0rc2
• Update to 3.9.24

HTMLParser quadratic complexity when processing malformed inputs

The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service.

• Update to 3.10.19
• Update to 3.11.14
• Update to 3.12.12
• Update to 3.13.6
• Update to 3.9.24

Bypass extraction filter to modify file metadata outside extraction directory

Allows modifying some file metadata (e.g. last modified) with filter="data" or file permissions (chmod) with filter="tar" of files outside the extraction directory. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter  for more information. Only Python versions 3.12 or later are affected by these vulnerabilities, earlier versions don't include the extraction filter fe

• Update to 3.10.18
• Update to 3.11.13
• Update to 3.12.11
• Update to 3.13.4
• Update to 3.9.23

Tarfile extracts filtered members when errorlevel=0

When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior is that any filtered members would be skipped and not extracted. However the actual behavior of TarFile.errorlevel = 0 in affected versions is that the member would still be extracted and not skipped.

• Update to 3.10.18
• Update to 3.11.13
• Update to 3.12.11
• Update to 3.13.4
• Update to 3.9.23

Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory

Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter  for more information. Note that for Python 3.14 or later the default value of filter= changed from "no filtering" to `"data", so if you are relying on this

• Update to 3.10.18
• Update to 3.11.13
• Update to 3.12.11
• Update to 3.13.4
• Update to 3.9.23

Extraction filter bypass for linking outside extraction directory

Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter  for more information. Note that for Python 3.14 or later the default value of filter= changed from "no filtering" to `"data", so if you are relying on this

• Update to 3.10.18
• Update to 3.11.13
• Update to 3.12.11
• Update to 3.13.4
• Update to 3.9.23

Arbitrary writes via tarfile realpath overflow

Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data". You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter  for more information. Note that for Python 3.14 or later the default value of filter= changed from "no filtering" to `"data", so if you are relying on this new default behavior then your usage is also affect

• Update to 3.10.18
• Update to 3.11.13
• Update to 3.12.11
• Update to 3.13.4
• Update to 3.9.23

Use-after-free in "unicode_escape" decoder with error handler

There is an issue in CPython when using `bytes.decode("unicode_escape", error="ignore|replace")`. If you are not using the "unicode_escape" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except catching the DecodeError.

• Update to 3.10.18
• Update to 3.11.13
• Update to 3.12.11
• Update to 3.13.4
• Update to 3.9.23

Mishandling of comma during folding and unicode-encoding of email headers

During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded then the separator itself is also unicode-encoded. Expected behavior is that the separating comma remains a plan comma. This can result in the address header being misinterpreted by some mail servers.

• Update to 3.10.17
• Update to 3.11.9
• Update to 3.12.3
• Update to 3.9.23

Default mimetype known files writeable on Windows

There is a defect in the CPython standard library module “mimetypes” where on Windows the default list of known file locations are writable meaning other users can create invalid files to cause MemoryError to be raised on Python runtime startup or have file extensions be interpreted as the incorrect file type. This defect is caused by the default locations of Linux and macOS platforms (such as “/etc/mime.types”) also being used on Windows, where they are user-writable locations (“C:\etc\mime.types”). To work-around this issue a user can call mimetypes.init() with an empty list (“[]”) on Windows platforms to avoid using the default list of k

• Update to 3.14.9
• Update to 3.15.1
• Update to 3.16.0