pkg:Bitnami/libpython

All known vulnerabilities

• CRITICAL9.8CVE-2020-15801In Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations.
  >= 3.7.0, < 3.7.9, >= 3.8.0, < 3.8.5
• CRITICAL9.8CVE-2022-48565An XML External Entity (XXE) issue was discovered in Python through 3.9.1.
  from 0, < 3.6.13, >= 3.7.0, < 3.7.10, >= 3.8.0, < 3.8.7, >= 3.9.0, < 3.9.1
• CRITICAL9.8CVE-2021-29921In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string.
  >= 3.8.0, < 3.8.12, >= 3.9.0, < 3.9.5
• CRITICAL9.8python2.7 - security update
  from 0, < 3.6.13, >= 3.7.0, < 3.7.10, >= 3.8.0, < 3.8.8, >= 3.9.0, < 3.9.2
• CRITICAL9.8In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP.
  >= 3.0.0, < 3.6.13, >= 3.7.0, < 3.7.10, >= 3.8.0, < 3.8.7, >= 3.9.0, < 3.9.1
• CRITICAL9.4Arbitrary writes via tarfile realpath overflow
  from 0, < 3.9.23, >= 3.10.0, < 3.10.18, >= 3.11.0, < 3.11.13, >= 3.12.0, < 3.12.11, >= 3.13.0, < 3.13.4
• HIGH7.8In Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4, and 3.9 through 3.9.0 on Windows, a Trojan horse python3.dll might be u…
  >= 3.5.0, < 3.5.10, >= 3.6.0, < 3.6.12, >= 3.7.0, < 3.7.9, >= 3.8.0, < 3.8.4
• HIGH7.8Virtual environment (venv) activation scripts don't quote paths
  from 0, < 3.9.21, >= 3.10.0, < 3.10.16, >= 3.11.0, < 3.11.11, >= 3.12.0, < 3.12.8, >= 3.13.0, < 3.13.1
• HIGH7.8python3.7 - security update
  from 0, < 3.8.19, >= 3.9.0, < 3.9.19, >= 3.10.0, < 3.10.14, >= 3.11.0, < 3.11.8, >= 3.12.0, < 3.12.1
• HIGH7.8Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non-default configuration.
  >= 3.7.3, < 3.7.16, >= 3.8.3, < 3.8.16, >= 3.9.0, < 3.9.16, >= 3.10.0, < 3.10.9
• HIGH7.5Excessive read buffering DoS in http.client
  from 0, < 3.10.20, >= 3.11.0, < 3.11.15, >= 3.12.0, < 3.12.13, >= 3.13.0, < 3.13.11, >= 3.14.0, < 3.14.1
• HIGH7.5The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger "RecursionError: maximum recursion depth exc…
  from 0, < 3.11.5
• HIGH7.5Tarfile infinite loop during parsing with negative member offset
  from 0, < 3.9.24, >= 3.10.0, < 3.10.19, >= 3.11.0, < 3.11.14, >= 3.12.0, < 3.12.12, >= 3.13.0, < 3.13.6
• HIGH7.5Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory
  from 0, < 3.9.23, >= 3.10.0, < 3.10.18, >= 3.11.0, < 3.11.13, >= 3.12.0, < 3.12.11, >= 3.13.0, < 3.13.4
• HIGH7.5Regular-expression DoS when parsing TarFile headers
  from 0, < 3.8.20, >= 3.9.0, < 3.9.20, >= 3.10.0, < 3.10.15, >= 3.11.0, < 3.11.10, >= 3.12.0, < 3.12.6
• HIGH7.5Quadratic complexity parsing cookies with backslashes
  from 0, < 3.8.20, >= 3.9.0, < 3.9.20, >= 3.10.0, < 3.10.15, >= 3.11.0, < 3.11.10, >= 3.12.0, < 3.12.6
• HIGH7.5Incorrect IPv4 and IPv6 private ranges
  from 0, < 3.8.20, >= 3.9.0, < 3.9.20, >= 3.10.0, < 3.10.15, >= 3.11.0, < 3.11.10, >= 3.12.0, < 3.12.4
• HIGH7.5An issue was discovered in Python 3.11 through 3.11.4.
  >= 3.11.0, < 3.11.5
• HIGH7.5python3.7 - security update
  from 0, < 3.6.11, >= 3.7.0, < 3.7.7, >= 3.8.0, < 3.8.2
• HIGH7.5pypy3 - security update
  from 0, < 3.7.17, >= 3.8.0, < 3.8.17, >= 3.9.0, < 3.9.17, >= 3.10.0, < 3.10.12, >= 3.11.0, < 3.11.4
• HIGH7.5An issue was discovered in Python before 3.11.1.
  from 0, < 3.7.16, >= 3.10.0, < 3.10.9, >= 3.11.0, < 3.11.1, >= 3.8.0, < 3.8.16, >= 3.9.0, < 3.9.16
• HIGH7.5pypy3 - security update
  >= 3.7.0, < 3.7.14, >= 3.8.0, < 3.8.14, >= 3.9.0, < 3.9.14, >= 3.10.0, < 3.10.7
• HIGH7.5A flaw was found in python.
  >= 3.6.0, < 3.6.14, >= 3.7.0, < 3.7.11, >= 3.8.0, < 3.8.11, >= 3.9.0, < 3.9.6
• HIGH7.5python3.9 - security update
  from 0, < 3.6.14, >= 3.7.0, < 3.7.11, >= 3.8.0, < 3.8.11, >= 3.9.0, < 3.9.5
• HIGH7.4Memory race condition in ssl.SSLContext certificate store methods
  from 0, < 3.8.20, >= 3.9.0, < 3.9.20, >= 3.10.0, < 3.10.14, >= 3.11.0, < 3.11.9, >= 3.12.0, < 3.12.3
• HIGH7.4Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginn…
  >= 3.0.0, < 3.7.14, >= 3.8.0, < 3.8.14, >= 3.9.0, < 3.9.14, >= 3.10.0, < 3.10.6
• HIGH7.2http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attac…
  >= 3.0.0, < 3.5.10, >= 3.6.0, < 3.6.12, >= 3.7.0, < 3.7.9, >= 3.8.0, < 3.8.5
• HIGH7.0In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured.
  from 0, < 3.7.13, >= 3.10.0, < 3.10.3, >= 3.8.0, < 3.8.13, >= 3.9.0, < 3.9.11
• MEDIUM6.5Buffer overread when using an empty list with SSLContext.set_npn_protocols()
  from 0, < 3.9.24
• MEDIUM6.5read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malform…
  from 0, < 3.6.13, >= 3.7.0, < 3.7.10, >= 3.8.0, < 3.8.7, >= 3.9.0, < 3.9.1
• MEDIUM6.5python3.5 - security update
  from 0, < 3.6.14, >= 3.7.0, < 3.7.11, >= 3.8.0, < 3.8.10, >= 3.9.0, < 3.9.5
• MEDIUM6.5Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct…
  >= 2.7.0, < 2.7.18, >= 3.5.0, < 3.5.10, >= 3.6.0, < 3.6.11, >= 3.7.0, < 3.7.7, >= 3.8.0, < 3.8.2
• MEDIUM6.2Quoted zip-bomb protection for zipfile
  from 0, < 3.8.19, >= 3.9.0, < 3.9.19, >= 3.10.0, < 3.10.14, >= 3.11.0, < 3.11.8, >= 3.12.0, < 3.12.2
• MEDIUM6.1BaseCookie.js_output() does not neutralize embedded characters
  from 0, < 3.13.14, >= 3.14.0, < 3.14.5
• MEDIUM5.9expat - security update
  from 0, < 3.9.21, >= 3.10.0, < 3.10.16, >= 3.11.0, < 3.11.11, >= 3.12.0, < 3.12.8, >= 3.13.0, < 3.13.1
• MEDIUM5.9An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1.
  from 0, < 3.6.13, >= 3.7.0, < 3.7.10, >= 3.8.0, < 3.8.7, >= 3.9.0, < 3.9.1
• MEDIUM5.9Web Cache Poisoning
  from 0, < 3.6.13, >= 3.7.0, < 3.7.10, >= 3.8.0, < 3.8.8, >= 3.9.0, < 3.9.2
• MEDIUM5.9python-ipaddress - security update
  >= 3.0.0, < 3.5.10, >= 3.6.0, < 3.6.12, >= 3.7.0, < 3.7.9, >= 3.8.0, < 3.8.4
• MEDIUM5.7There's a flaw in Python 3's pydoc.
  from 0, < 2.7.18, >= 3.6.0, < 3.6.13, >= 3.7.0, < 3.7.10, >= 3.8.0, < 3.8.8, >= 3.9.0, < 3.9.3
• MEDIUM5.5Out-of-memory when loading Plist
  from 0, < 3.13.10, >= 3.14.0, < 3.14.1
• MEDIUM5.5Quadratic complexity in os.path.expandvars() with user-controlled template
  from 0, < 3.9.25, >= 3.10.0, < 3.10.20, >= 3.11.0, < 3.11.15, >= 3.12.0, < 3.12.13, >= 3.13.0, < 3.13.10, >= 3.14.0, < 3.14.1
• MEDIUM5.5CPython v3.12.0 alpha 7 was discovered to contain a heap use-after-free via the function ascii_decode at /Objects/unicodeobject.c.
  >= 3.12.0-alpha0, < 3.12.0-alpha8
• MEDIUM5.5Email header injection due to unquoted newlines
  from 0, < 3.8.20, >= 3.9.0, < 3.9.20, >= 3.10.0, < 3.10.15, >= 3.11.0, < 3.11.10, >= 3.12.0, < 3.12.5
• MEDIUM5.5In Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an insecure dependency load upon launch on Windows 7 may…
  >= 3.6.0, < 3.6.11, >= 3.7.0, < 3.7.7, >= 3.8.0, < 3.8.2
• MEDIUM5.3base64.b64decode() always accepts "+/" characters, despite setting altchars
  from 0, < 3.15.0
• MEDIUM5.3Quadratic complexity in node ID cache clearing
  from 0, < 3.10.20, >= 3.11.0, < 3.11.15, >= 3.12.0, < 3.12.13, >= 3.13.0, < 3.13.11, >= 3.14.0, < 3.14.2
• MEDIUM5.3Bypass extraction filter to modify file metadata outside extraction directory
  from 0, < 3.9.23, >= 3.10.0, < 3.10.18, >= 3.11.0, < 3.11.13, >= 3.12.0, < 3.12.11, >= 3.13.0, < 3.13.4
• MEDIUM5.3An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5.
  from 0, < 3.8.18, >= 3.9.0, < 3.9.18, >= 3.10.0, < 3.10.13, >= 3.11.0, < 3.11.5
• MEDIUM5.3The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character.
  from 0, < 3.8.20, >= 3.10.0, < 3.10.15, >= 3.11.0, < 3.11.10, >= 3.12.0, < 3.12.6, >= 3.9.0, < 3.9.20
• MEDIUM5.3A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode.
  >= 3.6.0, < 3.6.14, >= 3.7.0, < 3.7.11, >= 3.8.0, < 3.8.9, >= 3.9.0, < 3.9.3, >= 3.10.0, < 3.10.1
• MEDIUM4.9Groups not dropped before running subprocess when using empty 'extra_groups' parameter
  >= 3.12.0, < 3.12.1
• MEDIUM4.3ZIP64 End of Central Directory (EOCD) Locator record offset not checked
  from 0, < 3.9.24, >= 3.10.0, < 3.10.19, >= 3.11.0, < 3.11.14, >= 3.12.0, < 3.12.12, >= 3.13.0, < 3.13.10, >= 3.14.0, < 3.14.1
• MEDIUM4.3HTMLParser quadratic complexity when processing malformed inputs
  from 0, < 3.9.24, >= 3.10.0, < 3.10.19, >= 3.11.0, < 3.11.14, >= 3.12.0, < 3.12.12, >= 3.13.0, < 3.13.6
• —Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations
  from 0, < 3.15.0
• —Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes
  from 0, < 3.13.14, >= 3.14.0, < 3.14.5
• —tarfile opened in streaming mode mishandles EOF
  from 0
• —Configuration Injection via Carriage Return (\r) in write() method
  from 0
• —tarfile extraction filter bypass allows escaping the destination directory
  from 0
• —CPython >3.11 Insecure Input Validation resulting in privilege escalation
  from 0
• —shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs
  from 0, < 3.14.5
• —Out-of-bounds read/write during remote profiling and asyncio process introspection when connecting to malicious target
  >= 3.14.0, < 3.14.5
• —Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()
  from 0, < 3.13.14, >= 3.14.0, < 3.14.5
• —email BytesGenerator header injection due to unquoted newlines
  from 0, < 3.10.20, >= 3.11.0, < 3.11.15, >= 3.12.0, < 3.12.13, >= 3.13.0, < 3.13.12, >= 3.14.0, < 3.14.3
• —wsgiref.headers.Headers allows header newline injection
  from 0, < 3.10.20, >= 3.11.0, < 3.11.15, >= 3.12.0, < 3.12.13, >= 3.13.0, < 3.13.12, >= 3.14.0, < 3.14.3
• —Header injection in http.cookies.Morsel
  from 0, < 3.10.20, >= 3.11.0, < 3.11.15, >= 3.12.0, < 3.12.13, >= 3.13.0, < 3.13.12, >= 3.14.0, < 3.14.3
• —POP3 command injection in user-controlled commands
  from 0, < 3.15.0
• —IMAP command injection in user-controlled commands
  from 0, < 3.15.0
• —Header injection via newlines in data URL mediatype
  from 0, < 3.10.20, >= 3.11.0, < 3.11.15, >= 3.12.0, < 3.12.13, >= 3.13.0, < 3.13.12, >= 3.14.0, < 3.14.3
• —Folding email comments of unfoldable characters doesn't preserve parenthesis
  from 0, < 3.10.20, >= 3.11.0, < 3.11.15, >= 3.12.0, < 3.12.13, >= 3.13.0, < 3.13.12, >= 3.14.0, < 3.14.3
• —Use-after-free in "unicode_escape" decoder with error handler
  from 0, < 3.9.23, >= 3.10.0, < 3.10.18, >= 3.11.0, < 3.11.13, >= 3.12.0, < 3.12.11, >= 3.13.0, < 3.13.4
• —Mishandling of comma during folding and unicode-encoding of email headers
  from 0, < 3.9.23, >= 3.10.0, < 3.10.17, >= 3.11.0, < 3.11.9, >= 3.12.0, < 3.12.3
• —URL parser allowed square brackets in domain names
  from 0, < 3.9.22, >= 3.10.0, < 3.10.17, >= 3.11.0, < 3.11.12, >= 3.12.0, < 3.12.9, >= 3.13.0, < 3.13.2
• —Unbounded memory buffering in SelectorSocketTransport.writelines()
  >= 3.12.0, < 3.12.9, >= 3.13.0, < 3.13.2
• —Improper validation of IPv6 and IPvFuture addresses
  from 0, < 3.9.21, >= 3.10.0, < 3.10.16, >= 3.11.0, < 3.11.4
• —Infinite loop when iterating over zip archive entry names from zipfile.Path
  from 0, < 3.8.20, >= 3.9.0, < 3.9.20, >= 3.10.0, < 3.10.15, >= 3.11.0, < 3.11.10, >= 3.12.0, < 3.12.6