Vulnerability-Lookup

RHSA-2025:23530

Vulnerability from csaf_redhat - Published: 2025-12-18 01:35 - Updated: 2026-08-31 11:35

Summary

Red Hat Security Advisory: python39:3.9 security update

Severity

Important

Notes

Topic: An update for the python39:3.9 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Invalid value for OpenSSL API may cause Buffer over-read when NPN is used (CVE-2024-5642) * python: Virtual environment (venv) activation scripts don't quote paths (CVE-2024-9287) * python: Improper validation of IPv6 and IPvFuture addresses (CVE-2024-11168) * python: cpython: URL parser allowed square brackets in domain names (CVE-2025-0938) * cpython: python: CPython DecodeError Handling Vulnerability (CVE-2025-4516) * cpython: Tarfile extracts filtered members when errorlevel=0 (CVE-2025-4435) * cpython: python: Extraction filter bypass for linking outside extraction directory (CVE-2025-4330) * python: cpython: Arbitrary writes via tarfile realpath overflow (CVE-2025-4517) * cpython: python: Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory (CVE-2025-4138) * cpython: Python HTMLParser quadratic complexity (CVE-2025-6069) * cpython: python: Python zipfile End of Central Directory (EOCD) Locator record offset not checked (CVE-2025-8291) * python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2024-5642

A vulnerability was found in Python/CPython that does not disallow configuring an empty list ("[]") for SSLContext.set_npn_protocols(), which is an invalid value for the underlying OpenSSL API. This issue results in a buffer over-read when NPN is used. See CVE -2024-5535 for OpenSSL for more information.

2.7 (Low)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

CWE-20 - Improper Input Validation

Affected products

Fixed 229 products

Product	Version	Remediation
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:PyYAML-0:5.4.1-1.module+el8.9.0+19644+d68f775d.src::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:PyYAML-debugsource-0:5.4.1-1.module+el8.9.0+19644+d68f775d.aarch64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:PyYAML-debugsource-0:5.4.1-1.module+el8.9.0+19644+d68f775d.ppc64le::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:PyYAML-debugsource-0:5.4.1-1.module+el8.9.0+19644+d68f775d.s390x::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:PyYAML-debugsource-0:5.4.1-1.module+el8.9.0+19644+d68f775d.x86_64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:mod_wsgi-0:4.7.1-7.module+el8.10.0+23075+0aa18782.1.src::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:numpy-0:1.19.4-3.module+el8.9.0+19644+d68f775d.src::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:numpy-debugsource-0:1.19.4-3.module+el8.9.0+19644+d68f775d.aarch64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:numpy-debugsource-0:1.19.4-3.module+el8.9.0+19644+d68f775d.ppc64le::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:numpy-debugsource-0:1.19.4-3.module+el8.9.0+19644+d68f775d.s390x::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:numpy-debugsource-0:1.19.4-3.module+el8.9.0+19644+d68f775d.x86_64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-PyMySQL-0:0.10.1-2.module+el8.9.0+19644+d68f775d.src::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-cffi-0:1.14.3-2.module+el8.9.0+19644+d68f775d.src::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-cffi-debugsource-0:1.14.3-2.module+el8.9.0+19644+d68f775d.aarch64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-cffi-debugsource-0:1.14.3-2.module+el8.9.0+19644+d68f775d.ppc64le::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-cffi-debugsource-0:1.14.3-2.module+el8.9.0+19644+d68f775d.s390x::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-cffi-debugsource-0:1.14.3-2.module+el8.9.0+19644+d68f775d.x86_64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-chardet-0:3.0.4-19.module+el8.9.0+19644+d68f775d.src::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-cryptography-0:3.3.1-3.module+el8.10.0+21271+eccd1d86.src::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-cryptography-debugsource-0:3.3.1-3.module+el8.10.0+21271+eccd1d86.aarch64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-cryptography-debugsource-0:3.3.1-3.module+el8.10.0+21271+eccd1d86.ppc64le::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-cryptography-debugsource-0:3.3.1-3.module+el8.10.0+21271+eccd1d86.s390x::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-cryptography-debugsource-0:3.3.1-3.module+el8.10.0+21271+eccd1d86.x86_64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-idna-0:2.10-4.module+el8.10.0+21815+bb024982.src::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-lxml-0:4.6.5-1.module+el8.9.0+19644+d68f775d.src::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-lxml-debugsource-0:4.6.5-1.module+el8.9.0+19644+d68f775d.aarch64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-lxml-debugsource-0:4.6.5-1.module+el8.9.0+19644+d68f775d.ppc64le::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-lxml-debugsource-0:4.6.5-1.module+el8.9.0+19644+d68f775d.s390x::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-lxml-debugsource-0:4.6.5-1.module+el8.9.0+19644+d68f775d.x86_64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-ply-0:3.11-10.module+el8.9.0+19644+d68f775d.src::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-psutil-0:5.8.0-4.module+el8.9.0+19644+d68f775d.src::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-psutil-debugsource-0:5.8.0-4.module+el8.9.0+19644+d68f775d.aarch64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-psutil-debugsource-0:5.8.0-4.module+el8.9.0+19644+d68f775d.ppc64le::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-psutil-debugsource-0:5.8.0-4.module+el8.9.0+19644+d68f775d.s390x::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-psutil-debugsource-0:5.8.0-4.module+el8.9.0+19644+d68f775d.x86_64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-psycopg2-0:2.8.6-3.module+el8.10.0+21142+453d2b75.src::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-psycopg2-debugsource-0:2.8.6-3.module+el8.10.0+21142+453d2b75.aarch64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-psycopg2-debugsource-0:2.8.6-3.module+el8.10.0+21142+453d2b75.ppc64le::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-psycopg2-debugsource-0:2.8.6-3.module+el8.10.0+21142+453d2b75.s390x::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-psycopg2-debugsource-0:2.8.6-3.module+el8.10.0+21142+453d2b75.x86_64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-pycparser-0:2.20-3.module+el8.9.0+19644+d68f775d.src::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-pysocks-0:1.7.1-4.module+el8.9.0+19644+d68f775d.src::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-requests-0:2.25.0-3.module+el8.9.0+19644+d68f775d.src::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-toml-0:0.10.1-5.module+el8.9.0+19644+d68f775d.src::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-urllib3-0:1.25.10-5.module+el8.10.0+20443+f0a692fe.src::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-wheel-1:0.35.1-4.module+el8.9.0+19644+d68f775d.src::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-0:3.9.25-2.module+el8.10.0+23718+1842ae33.aarch64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-0:3.9.25-2.module+el8.10.0+23718+1842ae33.ppc64le::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-0:3.9.25-2.module+el8.10.0+23718+1842ae33.s390x::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-0:3.9.25-2.module+el8.10.0+23718+1842ae33.src::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-0:3.9.25-2.module+el8.10.0+23718+1842ae33.x86_64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-PyMySQL-0:0.10.1-2.module+el8.9.0+19644+d68f775d.noarch::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-cffi-0:1.14.3-2.module+el8.9.0+19644+d68f775d.aarch64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-cffi-0:1.14.3-2.module+el8.9.0+19644+d68f775d.ppc64le::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-cffi-0:1.14.3-2.module+el8.9.0+19644+d68f775d.s390x::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-cffi-0:1.14.3-2.module+el8.9.0+19644+d68f775d.x86_64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-cffi-debuginfo-0:1.14.3-2.module+el8.9.0+19644+d68f775d.aarch64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-cffi-debuginfo-0:1.14.3-2.module+el8.9.0+19644+d68f775d.ppc64le::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-cffi-debuginfo-0:1.14.3-2.module+el8.9.0+19644+d68f775d.s390x::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-cffi-debuginfo-0:1.14.3-2.module+el8.9.0+19644+d68f775d.x86_64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-chardet-0:3.0.4-19.module+el8.9.0+19644+d68f775d.noarch::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-cryptography-0:3.3.1-3.module+el8.10.0+21271+eccd1d86.aarch64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-cryptography-0:3.3.1-3.module+el8.10.0+21271+eccd1d86.ppc64le::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-cryptography-0:3.3.1-3.module+el8.10.0+21271+eccd1d86.s390x::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-cryptography-0:3.3.1-3.module+el8.10.0+21271+eccd1d86.x86_64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-cryptography-debuginfo-0:3.3.1-3.module+el8.10.0+21271+eccd1d86.aarch64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-cryptography-debuginfo-0:3.3.1-3.module+el8.10.0+21271+eccd1d86.ppc64le::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-cryptography-debuginfo-0:3.3.1-3.module+el8.10.0+21271+eccd1d86.s390x::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-cryptography-debuginfo-0:3.3.1-3.module+el8.10.0+21271+eccd1d86.x86_64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-debuginfo-0:3.9.25-2.module+el8.10.0+23718+1842ae33.aarch64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-debuginfo-0:3.9.25-2.module+el8.10.0+23718+1842ae33.ppc64le::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-debuginfo-0:3.9.25-2.module+el8.10.0+23718+1842ae33.s390x::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-debuginfo-0:3.9.25-2.module+el8.10.0+23718+1842ae33.x86_64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-debugsource-0:3.9.25-2.module+el8.10.0+23718+1842ae33.aarch64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-debugsource-0:3.9.25-2.module+el8.10.0+23718+1842ae33.ppc64le::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-debugsource-0:3.9.25-2.module+el8.10.0+23718+1842ae33.s390x::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-debugsource-0:3.9.25-2.module+el8.10.0+23718+1842ae33.x86_64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-devel-0:3.9.25-2.module+el8.10.0+23718+1842ae33.aarch64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-devel-0:3.9.25-2.module+el8.10.0+23718+1842ae33.ppc64le::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-devel-0:3.9.25-2.module+el8.10.0+23718+1842ae33.s390x::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-devel-0:3.9.25-2.module+el8.10.0+23718+1842ae33.x86_64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-idle-0:3.9.25-2.module+el8.10.0+23718+1842ae33.aarch64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-idle-0:3.9.25-2.module+el8.10.0+23718+1842ae33.ppc64le::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-idle-0:3.9.25-2.module+el8.10.0+23718+1842ae33.s390x::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-idle-0:3.9.25-2.module+el8.10.0+23718+1842ae33.x86_64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-idna-0:2.10-4.module+el8.10.0+21815+bb024982.noarch::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-libs-0:3.9.25-2.module+el8.10.0+23718+1842ae33.aarch64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-libs-0:3.9.25-2.module+el8.10.0+23718+1842ae33.ppc64le::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-libs-0:3.9.25-2.module+el8.10.0+23718+1842ae33.s390x::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-libs-0:3.9.25-2.module+el8.10.0+23718+1842ae33.x86_64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-lxml-0:4.6.5-1.module+el8.9.0+19644+d68f775d.aarch64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-lxml-0:4.6.5-1.module+el8.9.0+19644+d68f775d.ppc64le::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-lxml-0:4.6.5-1.module+el8.9.0+19644+d68f775d.s390x::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-lxml-0:4.6.5-1.module+el8.9.0+19644+d68f775d.x86_64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-lxml-debuginfo-0:4.6.5-1.module+el8.9.0+19644+d68f775d.aarch64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-lxml-debuginfo-0:4.6.5-1.module+el8.9.0+19644+d68f775d.ppc64le::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-lxml-debuginfo-0:4.6.5-1.module+el8.9.0+19644+d68f775d.s390x::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-lxml-debuginfo-0:4.6.5-1.module+el8.9.0+19644+d68f775d.x86_64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-mod_wsgi-0:4.7.1-7.module+el8.10.0+23075+0aa18782.1.aarch64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-mod_wsgi-0:4.7.1-7.module+el8.10.0+23075+0aa18782.1.ppc64le::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-mod_wsgi-0:4.7.1-7.module+el8.10.0+23075+0aa18782.1.s390x::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-mod_wsgi-0:4.7.1-7.module+el8.10.0+23075+0aa18782.1.x86_64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-numpy-0:1.19.4-3.module+el8.9.0+19644+d68f775d.aarch64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-numpy-0:1.19.4-3.module+el8.9.0+19644+d68f775d.ppc64le::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-numpy-0:1.19.4-3.module+el8.9.0+19644+d68f775d.s390x::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-numpy-0:1.19.4-3.module+el8.9.0+19644+d68f775d.x86_64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-numpy-debuginfo-0:1.19.4-3.module+el8.9.0+19644+d68f775d.aarch64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-numpy-debuginfo-0:1.19.4-3.module+el8.9.0+19644+d68f775d.ppc64le::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-numpy-debuginfo-0:1.19.4-3.module+el8.9.0+19644+d68f775d.s390x::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-numpy-debuginfo-0:1.19.4-3.module+el8.9.0+19644+d68f775d.x86_64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-numpy-doc-0:1.19.4-3.module+el8.9.0+19644+d68f775d.noarch::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-numpy-f2py-0:1.19.4-3.module+el8.9.0+19644+d68f775d.aarch64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-numpy-f2py-0:1.19.4-3.module+el8.9.0+19644+d68f775d.ppc64le::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-numpy-f2py-0:1.19.4-3.module+el8.9.0+19644+d68f775d.s390x::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-numpy-f2py-0:1.19.4-3.module+el8.9.0+19644+d68f775d.x86_64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-pip-0:20.2.4-9.module+el8.10.0+21329+8d76b841.noarch::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-pip-wheel-0:20.2.4-9.module+el8.10.0+21329+8d76b841.noarch::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-ply-0:3.11-10.module+el8.9.0+19644+d68f775d.noarch::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-psutil-0:5.8.0-4.module+el8.9.0+19644+d68f775d.aarch64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-psutil-0:5.8.0-4.module+el8.9.0+19644+d68f775d.ppc64le::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-psutil-0:5.8.0-4.module+el8.9.0+19644+d68f775d.s390x::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-psutil-0:5.8.0-4.module+el8.9.0+19644+d68f775d.x86_64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-psutil-debuginfo-0:5.8.0-4.module+el8.9.0+19644+d68f775d.aarch64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-psutil-debuginfo-0:5.8.0-4.module+el8.9.0+19644+d68f775d.ppc64le::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-psutil-debuginfo-0:5.8.0-4.module+el8.9.0+19644+d68f775d.s390x::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-psutil-debuginfo-0:5.8.0-4.module+el8.9.0+19644+d68f775d.x86_64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-psycopg2-0:2.8.6-3.module+el8.10.0+21142+453d2b75.aarch64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-psycopg2-0:2.8.6-3.module+el8.10.0+21142+453d2b75.ppc64le::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-psycopg2-0:2.8.6-3.module+el8.10.0+21142+453d2b75.s390x::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-psycopg2-0:2.8.6-3.module+el8.10.0+21142+453d2b75.x86_64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-psycopg2-debuginfo-0:2.8.6-3.module+el8.10.0+21142+453d2b75.aarch64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-psycopg2-debuginfo-0:2.8.6-3.module+el8.10.0+21142+453d2b75.ppc64le::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-psycopg2-debuginfo-0:2.8.6-3.module+el8.10.0+21142+453d2b75.s390x::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-psycopg2-debuginfo-0:2.8.6-3.module+el8.10.0+21142+453d2b75.x86_64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-psycopg2-doc-0:2.8.6-3.module+el8.10.0+21142+453d2b75.aarch64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-psycopg2-doc-0:2.8.6-3.module+el8.10.0+21142+453d2b75.ppc64le::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-psycopg2-doc-0:2.8.6-3.module+el8.10.0+21142+453d2b75.s390x::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-psycopg2-doc-0:2.8.6-3.module+el8.10.0+21142+453d2b75.x86_64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-psycopg2-tests-0:2.8.6-3.module+el8.10.0+21142+453d2b75.aarch64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-psycopg2-tests-0:2.8.6-3.module+el8.10.0+21142+453d2b75.ppc64le::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-psycopg2-tests-0:2.8.6-3.module+el8.10.0+21142+453d2b75.s390x::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-psycopg2-tests-0:2.8.6-3.module+el8.10.0+21142+453d2b75.x86_64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-pycparser-0:2.20-3.module+el8.9.0+19644+d68f775d.noarch::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-pysocks-0:1.7.1-4.module+el8.9.0+19644+d68f775d.noarch::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-pyyaml-0:5.4.1-1.module+el8.9.0+19644+d68f775d.aarch64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-pyyaml-0:5.4.1-1.module+el8.9.0+19644+d68f775d.ppc64le::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-pyyaml-0:5.4.1-1.module+el8.9.0+19644+d68f775d.s390x::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-pyyaml-0:5.4.1-1.module+el8.9.0+19644+d68f775d.x86_64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-pyyaml-debuginfo-0:5.4.1-1.module+el8.9.0+19644+d68f775d.aarch64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-pyyaml-debuginfo-0:5.4.1-1.module+el8.9.0+19644+d68f775d.ppc64le::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-pyyaml-debuginfo-0:5.4.1-1.module+el8.9.0+19644+d68f775d.s390x::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-pyyaml-debuginfo-0:5.4.1-1.module+el8.9.0+19644+d68f775d.x86_64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-requests-0:2.25.0-3.module+el8.9.0+19644+d68f775d.noarch::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-rpm-macros-0:3.9.25-2.module+el8.10.0+23718+1842ae33.noarch::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-scipy-0:1.5.4-5.module+el8.9.0+19644+d68f775d.aarch64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-scipy-0:1.5.4-5.module+el8.9.0+19644+d68f775d.ppc64le::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-scipy-0:1.5.4-5.module+el8.9.0+19644+d68f775d.s390x::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-scipy-0:1.5.4-5.module+el8.9.0+19644+d68f775d.x86_64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-scipy-debuginfo-0:1.5.4-5.module+el8.9.0+19644+d68f775d.aarch64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-scipy-debuginfo-0:1.5.4-5.module+el8.9.0+19644+d68f775d.ppc64le::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-scipy-debuginfo-0:1.5.4-5.module+el8.9.0+19644+d68f775d.s390x::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-scipy-debuginfo-0:1.5.4-5.module+el8.9.0+19644+d68f775d.x86_64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-setuptools-0:50.3.2-7.module+el8.10.0+23406+03055bfb.noarch::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-setuptools-wheel-0:50.3.2-7.module+el8.10.0+23406+03055bfb.noarch::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-six-0:1.15.0-3.module+el8.9.0+19644+d68f775d.noarch::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-test-0:3.9.25-2.module+el8.10.0+23718+1842ae33.aarch64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-test-0:3.9.25-2.module+el8.10.0+23718+1842ae33.ppc64le::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-test-0:3.9.25-2.module+el8.10.0+23718+1842ae33.s390x::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-test-0:3.9.25-2.module+el8.10.0+23718+1842ae33.x86_64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-tkinter-0:3.9.25-2.module+el8.10.0+23718+1842ae33.aarch64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-tkinter-0:3.9.25-2.module+el8.10.0+23718+1842ae33.ppc64le::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-tkinter-0:3.9.25-2.module+el8.10.0+23718+1842ae33.s390x::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-tkinter-0:3.9.25-2.module+el8.10.0+23718+1842ae33.x86_64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-toml-0:0.10.1-5.module+el8.9.0+19644+d68f775d.noarch::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-urllib3-0:1.25.10-5.module+el8.10.0+20443+f0a692fe.noarch::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-wheel-1:0.35.1-4.module+el8.9.0+19644+d68f775d.noarch::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python39-wheel-wheel-1:0.35.1-4.module+el8.9.0+19644+d68f775d.noarch::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3x-pip-0:20.2.4-9.module+el8.10.0+21329+8d76b841.src::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3x-setuptools-0:50.3.2-7.module+el8.10.0+23406+03055bfb.src::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3x-six-0:1.15.0-3.module+el8.9.0+19644+d68f775d.src::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:scipy-0:1.5.4-5.module+el8.9.0+19644+d68f775d.src::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:scipy-debugsource-0:1.5.4-5.module+el8.9.0+19644+d68f775d.aarch64::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:scipy-debugsource-0:1.5.4-5.module+el8.9.0+19644+d68f775d.ppc64le::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:scipy-debugsource-0:1.5.4-5.module+el8.9.0+19644+d68f775d.s390x::python39:3.9	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:scipy-debugsource-0:1.5.4-5.module+el8.9.0+19644+d68f775d.x86_64::python39:3.9	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:Cython-0:0.29.21-5.module+el8.9.0+19644+d68f775d.src::python39-devel:3.9	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:Cython-debugsource-0:0.29.21-5.module+el8.9.0+19644+d68f775d.aarch64::python39-devel:3.9	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:Cython-debugsource-0:0.29.21-5.module+el8.9.0+19644+d68f775d.ppc64le::python39-devel:3.9	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:Cython-debugsource-0:0.29.21-5.module+el8.9.0+19644+d68f775d.s390x::python39-devel:3.9	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:Cython-debugsource-0:0.29.21-5.module+el8.9.0+19644+d68f775d.x86_64::python39-devel:3.9	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:pybind11-0:2.7.1-1.module+el8.9.0+19644+d68f775d.src::python39-devel:3.9	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:pytest-0:6.0.2-2.module+el8.9.0+19644+d68f775d.src::python39-devel:3.9	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python-attrs-0:20.3.0-2.module+el8.9.0+19644+d68f775d.src::python39-devel:3.9	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python-iniconfig-0:1.1.1-2.module+el8.9.0+19644+d68f775d.src::python39-devel:3.9	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python-more-itertools-0:8.5.0-2.module+el8.9.0+19644+d68f775d.src::python39-devel:3.9	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python-packaging-0:20.4-4.module+el8.9.0+19644+d68f775d.src::python39-devel:3.9	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python-pluggy-0:0.13.1-3.module+el8.9.0+19644+d68f775d.src::python39-devel:3.9	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python-py-0:1.10.0-1.module+el8.9.0+19644+d68f775d.src::python39-devel:3.9	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python-wcwidth-0:0.2.5-3.module+el8.9.0+19644+d68f775d.src::python39-devel:3.9	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python39-Cython-0:0.29.21-5.module+el8.9.0+19644+d68f775d.aarch64::python39-devel:3.9	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python39-Cython-0:0.29.21-5.module+el8.9.0+19644+d68f775d.ppc64le::python39-devel:3.9	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python39-Cython-0:0.29.21-5.module+el8.9.0+19644+d68f775d.s390x::python39-devel:3.9	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python39-Cython-0:0.29.21-5.module+el8.9.0+19644+d68f775d.x86_64::python39-devel:3.9	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python39-Cython-debuginfo-0:0.29.21-5.module+el8.9.0+19644+d68f775d.aarch64::python39-devel:3.9	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python39-Cython-debuginfo-0:0.29.21-5.module+el8.9.0+19644+d68f775d.ppc64le::python39-devel:3.9	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python39-Cython-debuginfo-0:0.29.21-5.module+el8.9.0+19644+d68f775d.s390x::python39-devel:3.9	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python39-Cython-debuginfo-0:0.29.21-5.module+el8.9.0+19644+d68f775d.x86_64::python39-devel:3.9	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python39-attrs-0:20.3.0-2.module+el8.9.0+19644+d68f775d.noarch::python39-devel:3.9	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python39-debug-0:3.9.25-2.module+el8.10.0+23718+1842ae33.aarch64::python39-devel:3.9	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python39-debug-0:3.9.25-2.module+el8.10.0+23718+1842ae33.ppc64le::python39-devel:3.9	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python39-debug-0:3.9.25-2.module+el8.10.0+23718+1842ae33.s390x::python39-devel:3.9	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python39-debug-0:3.9.25-2.module+el8.10.0+23718+1842ae33.x86_64::python39-devel:3.9	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python39-iniconfig-0:1.1.1-2.module+el8.9.0+19644+d68f775d.noarch::python39-devel:3.9	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python39-more-itertools-0:8.5.0-2.module+el8.9.0+19644+d68f775d.noarch::python39-devel:3.9	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python39-packaging-0:20.4-4.module+el8.9.0+19644+d68f775d.noarch::python39-devel:3.9	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python39-pluggy-0:0.13.1-3.module+el8.9.0+19644+d68f775d.noarch::python39-devel:3.9	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python39-py-0:1.10.0-1.module+el8.9.0+19644+d68f775d.noarch::python39-devel:3.9	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python39-pybind11-0:2.7.1-1.module+el8.9.0+19644+d68f775d.aarch64::python39-devel:3.9	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python39-pybind11-0:2.7.1-1.module+el8.9.0+19644+d68f775d.ppc64le::python39-devel:3.9	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python39-pybind11-0:2.7.1-1.module+el8.9.0+19644+d68f775d.s390x::python39-devel:3.9	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python39-pybind11-0:2.7.1-1.module+el8.9.0+19644+d68f775d.x86_64::python39-devel:3.9	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python39-pybind11-devel-0:2.7.1-1.module+el8.9.0+19644+d68f775d.aarch64::python39-devel:3.9	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python39-pybind11-devel-0:2.7.1-1.module+el8.9.0+19644+d68f775d.ppc64le::python39-devel:3.9	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python39-pybind11-devel-0:2.7.1-1.module+el8.9.0+19644+d68f775d.s390x::python39-devel:3.9	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python39-pybind11-devel-0:2.7.1-1.module+el8.9.0+19644+d68f775d.x86_64::python39-devel:3.9	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python39-pyparsing-0:2.4.7-5.module+el8.9.0+19644+d68f775d.noarch::python39-devel:3.9	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python39-pytest-0:6.0.2-2.module+el8.9.0+19644+d68f775d.noarch::python39-devel:3.9	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python39-wcwidth-0:0.2.5-3.module+el8.9.0+19644+d68f775d.noarch::python39-devel:3.9	—	Vendor Fix fix
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3x-pyparsing-0:2.4.7-5.module+el8.9.0+19644+d68f775d.src::python39-devel:3.9	—	Vendor Fix fix

Threats

Impact Low

CVE-2024-9287

A vulnerability has been found in the Python `venv` module and CLI. Path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts, for example, "source venv/bin/activate". This flaw allows attacker-controlled virtual environments to run commands when the virtual environment is activated.

6.3 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:N

CWE-428 - Unquoted Search Path or Element

Affected products

Fixed 229 products, the same list as for CVE-2024-5642

Threats

Impact Moderate

CVE-2024-11168

A flaw was found in Python. The `urllib.parse.urlsplit()` and `urlparse()` functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture compliant. This behavior was not conformant to RFC 3986 and was potentially vulnerable to server-side request forgery (SSRF) if a URL is processed by more than one URL parser.

3.7 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE-1287 - Improper Validation of Specified Type of Input

Affected products

Fixed 229 products, the same list as for CVE-2024-5642

Threats

Impact Moderate

CVE-2025-0938

A flaw was found in Python. The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accept domain names that included square brackets, which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential parsing across the Python URL parser and other specification-compliant URL parsers.

6.8 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

CWE-20 - Improper Input Validation

Affected products

Fixed 229 products, the same list as for CVE-2024-5642

Threats

Impact Moderate

CVE-2025-4138

A flaw was found in the Python tarfile module. This vulnerability allows attackers to bypass extraction filters, enabling symlink targets to escape the destination directory and allowing unauthorized modification of file metadata via the use of TarFile.extract() or TarFile.extractall() with the filter= parameter set to "data" or "tar".

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected products

Fixed 229 products, the same list as for CVE-2024-5642

Threats

Impact Important

CVE-2025-4330

A flaw was found in CPython's tarfile module. This vulnerability allows bypassing of extraction filters, enabling symlink traversal outside the intended extraction directory and potential modification of file metadata via malicious tar archives using TarFile.extractall() or TarFile.extract() with the filter="data" or filter="tar" parameters. This issue leads to potentially overwriting or modifying system files and metadata.

7.3 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected products

Fixed 229 products, the same list as for CVE-2024-5642

Threats

Impact Moderate

CVE-2025-4435

A flaw was found in CPython's tarfile module. This vulnerability allows unauthorized file extraction via crafted tar archives when TarFile.errorlevel=0, bypassing expected filtering mechanisms.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE-706 - Use of Incorrectly-Resolved Name or Reference

Affected products

Fixed 229 products, the same list as for CVE-2024-5642

Threats

Impact Moderate

CVE-2025-4516

A vulnerability has been identified in CPython's bytes.decode() function when used with the "unicode_escape" encoding and the "ignore" or "replace" error handling modes. This flaw can result in the incorrect decoding of byte strings. While this may not directly lead to traditional security breaches like data exfiltration, the resulting unexpected program behavior could introduce instability, logic errors, or unintended side effects within applications that rely on this specific decoding functionality.

5.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-416 - Use After Free

Affected products

Fixed 229 products, the same list as for CVE-2024-5642

Threats

Impact Moderate

CVE-2025-4517

A flaw was found in the CPython tarfile module. This vulnerability allows arbitrary filesystem writes outside the extraction directory via extracting untrusted tar archives using the TarFile.extractall() or TarFile.extract() methods with the extraction filter parameter set to "data" or "tar".

7.6 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected products

Fixed 229 products, the same list as for CVE-2024-5642

Threats

Impact Important

CVE-2025-6069

A denial-of-service (DoS) vulnerability has been discovered in Python's html.parser.HTMLParser class. When processing specially malformed HTML input, the parsing runtime can become quadratic with respect to the input size. This significantly increased processing time can lead to excessive resource consumption, ultimately causing a denial-of-service condition in applications that rely on this parser.

4.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CWE-1333 - Inefficient Regular Expression Complexity

Affected products

Fixed 229 products, the same list as for CVE-2024-5642

Threats

Impact Moderate

CVE-2025-6075

A vulnerability in Python’s os.path.expandvars() function that can cause performance degradation. When processing specially crafted, user-controlled input with nested environment variable patterns, the function exhibits quadratic time complexity, potentially leading to excessive CPU usage and denial of service (DoS) conditions. No code execution or data exposure occurs, so the impact is limited to performance slowdown.

4.0 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 229 products, the same list as for CVE-2024-5642

Threats

Impact Low

CVE-2025-8291

A zip file handling flaw has been discovered in the python standard library `zipfile` module. The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be assumed to be the previous record in the ZIP archive. This could be abused to create ZIP archives that are handled differently by the 'zipfile' module compared to other ZIP implementations.

4.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CWE-130 - Improper Handling of Length Parameter Inconsistency

Affected products

Fixed 229 products, the same list as for CVE-2024-5642

Threats

Impact Moderate

References

98 references

URL	Category
https://access.redhat.com/errata/RHSA-2025:23530	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2294682	external
https://bugzilla.redhat.com/show_bug.cgi?id=2321440	external
https://bugzilla.redhat.com/show_bug.cgi?id=2325776	external
https://bugzilla.redhat.com/show_bug.cgi?id=2343237	external
https://bugzilla.redhat.com/show_bug.cgi?id=2366509	external
https://bugzilla.redhat.com/show_bug.cgi?id=2370010	external
https://bugzilla.redhat.com/show_bug.cgi?id=2370014	external
https://bugzilla.redhat.com/show_bug.cgi?id=2370016	external
https://bugzilla.redhat.com/show_bug.cgi?id=2372426	external
https://bugzilla.redhat.com/show_bug.cgi?id=2373234	external
https://bugzilla.redhat.com/show_bug.cgi?id=2402342	external
https://bugzilla.redhat.com/show_bug.cgi?id=2408891	external
https://issues.redhat.com/browse/RHEL-128539	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2024-5642	self
https://bugzilla.redhat.com/show_bug.cgi?id=2294682	external
https://www.cve.org/CVERecord?id=CVE-2024-5642	external
https://nvd.nist.gov/vuln/detail/CVE-2024-5642	external
https://mail.python.org/archives/list/security-an…	external
https://access.redhat.com/security/cve/CVE-2024-9287	self
https://bugzilla.redhat.com/show_bug.cgi?id=2321440	external
https://www.cve.org/CVERecord?id=CVE-2024-9287	external
https://nvd.nist.gov/vuln/detail/CVE-2024-9287	external
https://github.com/python/cpython/issues/124651	external
https://github.com/python/cpython/pull/124712	external
https://mail.python.org/archives/list/security-an…	external
https://access.redhat.com/security/cve/CVE-2024-11168	self
https://bugzilla.redhat.com/show_bug.cgi?id=2325776	external
https://www.cve.org/CVERecord?id=CVE-2024-11168	external
https://nvd.nist.gov/vuln/detail/CVE-2024-11168	external
https://github.com/python/cpython/commit/29f348e2…	external
https://github.com/python/cpython/commit/b2171a2f…	external
https://github.com/python/cpython/issues/103848	external
https://github.com/python/cpython/pull/103849	external
https://mail.python.org/archives/list/security-an…	external
https://access.redhat.com/security/cve/CVE-2025-0938	self
https://bugzilla.redhat.com/show_bug.cgi?id=2343237	external
https://www.cve.org/CVERecord?id=CVE-2025-0938	external
https://nvd.nist.gov/vuln/detail/CVE-2025-0938	external
https://github.com/python/cpython/issues/105704	external
https://github.com/python/cpython/pull/129418	external
https://access.redhat.com/security/cve/CVE-2025-4138	self
https://bugzilla.redhat.com/show_bug.cgi?id=2372426	external
https://www.cve.org/CVERecord?id=CVE-2025-4138	external
https://nvd.nist.gov/vuln/detail/CVE-2025-4138	external
https://gist.github.com/sethmlarson/52398e33eff26…	external
https://github.com/python/cpython/commit/3612d8f5…	external
https://github.com/python/cpython/commit/9e0ac76d…	external
https://github.com/python/cpython/issues/135034	external
https://github.com/python/cpython/pull/135037	external
https://mail.python.org/archives/list/security-an…	external
https://access.redhat.com/security/cve/CVE-2025-4330	self
https://bugzilla.redhat.com/show_bug.cgi?id=2370014	external
https://www.cve.org/CVERecord?id=CVE-2025-4330	external
https://nvd.nist.gov/vuln/detail/CVE-2025-4330	external
https://access.redhat.com/security/cve/CVE-2025-4435	self
https://bugzilla.redhat.com/show_bug.cgi?id=2370010	external
https://www.cve.org/CVERecord?id=CVE-2025-4435	external
https://nvd.nist.gov/vuln/detail/CVE-2025-4435	external
https://access.redhat.com/security/cve/CVE-2025-4516	self
https://bugzilla.redhat.com/show_bug.cgi?id=2366509	external
https://www.cve.org/CVERecord?id=CVE-2025-4516	external
https://nvd.nist.gov/vuln/detail/CVE-2025-4516	external
https://github.com/python/cpython/commit/69b4387f…	external
https://github.com/python/cpython/commit/9f69a586…	external
https://github.com/python/cpython/issues/133767	external
https://github.com/python/cpython/pull/129648	external
https://mail.python.org/archives/list/security-an…	external
https://access.redhat.com/security/cve/CVE-2025-4517	self
https://bugzilla.redhat.com/show_bug.cgi?id=2370016	external
https://www.cve.org/CVERecord?id=CVE-2025-4517	external
https://nvd.nist.gov/vuln/detail/CVE-2025-4517	external
https://access.redhat.com/security/cve/CVE-2025-6069	self
https://bugzilla.redhat.com/show_bug.cgi?id=2373234	external
https://www.cve.org/CVERecord?id=CVE-2025-6069	external
https://nvd.nist.gov/vuln/detail/CVE-2025-6069	external
https://github.com/python/cpython/commit/4455cbab…	external
https://github.com/python/cpython/commit/6eb6c5db…	external
https://github.com/python/cpython/commit/d851f8e2…	external
https://github.com/python/cpython/issues/135462	external
https://github.com/python/cpython/pull/135464	external
https://access.redhat.com/security/cve/CVE-2025-6075	self
https://bugzilla.redhat.com/show_bug.cgi?id=2408891	external
https://www.cve.org/CVERecord?id=CVE-2025-6075	external
https://nvd.nist.gov/vuln/detail/CVE-2025-6075	external
https://github.com/python/cpython/issues/136065	external
https://mail.python.org/archives/list/security-an…	external
https://access.redhat.com/security/cve/CVE-2025-8291	self
https://bugzilla.redhat.com/show_bug.cgi?id=2402342	external
https://www.cve.org/CVERecord?id=CVE-2025-8291	external
https://nvd.nist.gov/vuln/detail/CVE-2025-8291	external
https://github.com/python/cpython/commit/162997bb…	external
https://github.com/python/cpython/commit/333d4a6f…	external
https://github.com/python/cpython/issues/139700	external
https://github.com/python/cpython/pull/139702	external
https://mail.python.org/archives/list/security-an…	external

JSON

To clipboard

Loading 1.6 MB of JSON…

CVE-2024-11168 (GCVE-0-2024-11168)

Vulnerability from cvelistv5 – Published: 2024-11-12 21:22 – Updated: 2025-11-03 21:51

Title

Improper validation of IPv6 and IPvFuture addresses

Summary

The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser.

Severity

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/AU:N

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-11-13 15:09 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

PSF mitre root

References

9 references

URL	Tags
https://github.com/python/cpython/commit/29f348e2…	patch
https://github.com/python/cpython/pull/103849	patch
https://github.com/python/cpython/issues/103848	issue-tracking
https://mail.python.org/archives/list/security-an…	vendor-advisory
https://github.com/python/cpython/commit/b2171a2f…	patch
https://github.com/python/cpython/commit/634ded45…	patch
https://github.com/python/cpython/commit/ddca2953…	patch
https://security.netapp.com/advisory/ntap-2025041…
https://lists.debian.org/debian-lts-announce/2024…

Impacted products

2 products

Vendor	Product	Version
Python Software Foundation	CPython	Affected: 0 , < 3.9.21 (python) Affected: 3.10.0 , < 3.10.16 (python) Affected: 3.11.0 , < 3.11.4 (python) Affected: 3.12.0a1 , < 3.12.0b1 (python)
python_software_foundation	cpython	Affected: 0 , < 3.11.4 (custom) Affected: 3.12.0a1 , < 3.12.0b1 (custom) cpe:2.3:a:python_software_foundation:cpython::::::::

Credits

zer0yu (IPASSLab && ZGC Lab)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:python_software_foundation:cpython:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "cpython",
            "vendor": "python_software_foundation",
            "versions": [
              {
                "lessThan": "3.11.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThan": "3.12.0b1",
                "status": "affected",
                "version": "3.12.0a1",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 3.7,
              "baseSeverity": "LOW",
              "confidentialityImpact": "NONE",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-11168",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-13T15:09:42.748084Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-918",
                "description": "CWE-918 Server-Side Request Forgery (SSRF)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-06T17:59:48.232Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:51:45.721Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20250411-0004/"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "CPython",
          "repo": "https://github.com/python/cpython",
          "vendor": "Python Software Foundation",
          "versions": [
            {
              "lessThan": "3.9.21",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            },
            {
              "lessThan": "3.10.16",
              "status": "affected",
              "version": "3.10.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.11.4",
              "status": "affected",
              "version": "3.11.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.12.0b1",
              "status": "affected",
              "version": "3.12.0a1",
              "versionType": "python"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "zer0yu (IPASSLab \u0026\u0026 ZGC Lab)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren\u0027t IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser.\u003cbr\u003e"
            }
          ],
          "value": "The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren\u0027t IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NO",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/AU:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-03T20:29:59.700Z",
        "orgId": "28c92f92-d60d-412d-b760-e73465c3df22",
        "shortName": "PSF"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/29f348e232e82938ba2165843c448c2b291504c5"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/pull/103849"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/python/cpython/issues/103848"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/XPWB6XVZ5G5KGEI63M4AWLIEUF5BPH4T/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/b2171a2fd41416cf68afd67460578631d755a550"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/634ded45545ce8cbd6fd5d49785613dd7fa9b89e"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/ddca2953191c67a12b1f19d6bca41016c6ae7132"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Improper validation of IPv6 and IPvFuture addresses",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22",
    "assignerShortName": "PSF",
    "cveId": "CVE-2024-11168",
    "datePublished": "2024-11-12T21:22:23.438Z",
    "dateReserved": "2024-11-12T21:13:15.779Z",
    "dateUpdated": "2025-11-03T21:51:45.721Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-5642 (GCVE-0-2024-5642)

Vulnerability from cvelistv5 – Published: 2024-06-27 21:05 – Updated: 2026-07-31 14:06

Title

Buffer overread when using an empty list with SSLContext.set_npn_protocols()

Summary

CPython 3.9 and earlier doesn't disallow configuring an empty list ("[]") for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vulnerability is of low severity due to NPN being not widely used and specifying an empty list likely being uncommon in-practice (typically a protocol name would be configured).

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-06-28 13:47 UTC

CWE

CWE-noinfo Not enough information

Assigner

PSF mitre root

References

8 references

URL	Tags
https://jbp.io/2024/06/27/cve-2024-5535-openssl-m…	third-party-advisory
https://github.com/python/cpython/pull/23014	mitigation
https://mail.python.org/archives/list/security-an…	vendor-advisory
https://github.com/python/cpython/commit/39258d35…	patch
http://www.openwall.com/lists/oss-security/2024/06/28/4
https://github.com/python/cpython/issues/121227	issue-tracking
https://security.netapp.com/advisory/ntap-2024072…
https://github.com/python/cpython/commit/a2cdbb6e…	patch

Impacted products

1 product

Vendor	Product	Version
Python Software Foundation	CPython	Affected: 0 , < 3.9.24 (python) Affected: 3.10.0a1 , < 3.10.0b1 (python)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-5642",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-28T13:47:34.169947Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-06T20:14:30.590Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T21:18:06.642Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "third-party-advisory",
              "x_transferred"
            ],
            "url": "https://jbp.io/2024/06/27/cve-2024-5535-openssl-memory-safety.html"
          },
          {
            "tags": [
              "mitigation",
              "x_transferred"
            ],
            "url": "https://github.com/python/cpython/pull/23014"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/PLP2JI3PJY33YG6P5BZYSSNU66HASXBQ/"
          },
          {
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/python/cpython/commit/39258d3595300bc7b952854c915f63ae2d4b9c3e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/06/28/4"
          },
          {
            "tags": [
              "issue-tracking",
              "x_transferred"
            ],
            "url": "https://github.com/python/cpython/issues/121227"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240726-0005/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "CPython",
          "repo": "https://github.com/python/cpython",
          "vendor": "Python Software Foundation",
          "versions": [
            {
              "lessThan": "3.9.24",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            },
            {
              "lessThan": "3.10.0b1",
              "status": "affected",
              "version": "3.10.0a1",
              "versionType": "python"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "CPython 3.9 and earlier doesn\u0027t disallow configuring an empty list (\"[]\") for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see \u003cspan style=\"background-color: oklab(0.0852327 0.00000386313 0.00000170618 / 0.06);\"\u003eCVE\u003c/span\u003e\u003cspan style=\"background-color: oklab(0.0852327 0.00000386313 0.00000170618 / 0.06);\"\u003e-2024\u003c/span\u003e\u003cspan style=\"background-color: oklab(0.0852327 0.00000386313 0.00000170618 / 0.06);\"\u003e-5535\u003c/span\u003e for OpenSSL). This vulnerability is of low severity due to NPN being not widely used and specifying an empty list likely being uncommon in-practice (typically a protocol name would be configured).\u003cbr\u003e"
            }
          ],
          "value": "CPython 3.9 and earlier doesn\u0027t disallow configuring an empty list (\"[]\") for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vulnerability is of low severity due to NPN being not widely used and specifying an empty list likely being uncommon in-practice (typically a protocol name would be configured)."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-31T14:06:47.138Z",
        "orgId": "28c92f92-d60d-412d-b760-e73465c3df22",
        "shortName": "PSF"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://jbp.io/2024/06/27/cve-2024-5535-openssl-memory-safety.html"
        },
        {
          "tags": [
            "mitigation"
          ],
          "url": "https://github.com/python/cpython/pull/23014"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/PLP2JI3PJY33YG6P5BZYSSNU66HASXBQ/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/39258d3595300bc7b952854c915f63ae2d4b9c3e"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2024/06/28/4"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/python/cpython/issues/121227"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240726-0005/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/a2cdbb6e8188ba9ba8b356b28d91bff60e86fe31"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Buffer overread when using an empty list with SSLContext.set_npn_protocols()",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22",
    "assignerShortName": "PSF",
    "cveId": "CVE-2024-5642",
    "datePublished": "2024-06-27T21:05:31.281Z",
    "dateReserved": "2024-06-04T18:40:21.539Z",
    "dateUpdated": "2026-07-31T14:06:47.138Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-9287 (GCVE-0-2024-9287)

Vulnerability from cvelistv5 – Published: 2024-10-22 16:34 – Updated: 2025-11-03 22:33

Title

Virtual environment (venv) activation scripts don't quote paths

Summary

A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren't activated before being used (ie "./venv/bin/python") are not affected.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/U:Green

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-07-22 00:00 UTC

CWE

CWE-428 - Unquoted Search Path or Element

Assigner

PSF mitre root

References

12 references

URL	Tags
https://github.com/python/cpython/issues/124651	issue-tracking
https://github.com/python/cpython/pull/124712	patch
https://mail.python.org/archives/list/security-an…	vendor-advisory
https://github.com/python/cpython/commit/e52095a0…	patch
https://github.com/python/cpython/commit/63355573…	patch
https://github.com/python/cpython/commit/8450b248…	patch
https://github.com/python/cpython/commit/9286ab3a…	patch
https://github.com/python/cpython/commit/ae961ae9…	patch
https://github.com/python/cpython/commit/d48cc82e…	patch
https://security.netapp.com/advisory/ntap-2025042…
https://lists.debian.org/debian-lts-announce/2024…
https://lists.debian.org/debian-lts-announce/2024…

Impacted products

2 products

Vendor	Product	Version
Python Software Foundation	CPython	Affected: 0 , < 3.9.21 (python) Affected: 3.10.0 , < 3.10.16 (python) Affected: 3.11.0 , < 3.11.11 (python) Affected: 3.12.0 , < 3.12.8 (python) Affected: 3.13.0 , < 3.13.1 (python) Affected: 3.14.0a1 , < 3.14.0a2 (python)
python	cpython	Affected: 0 , ≤ 3.13.0 (python) cpe:2.3:a:python:cpython::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:python:cpython:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "cpython",
            "vendor": "python",
            "versions": [
              {
                "lessThanOrEqual": "3.13.0",
                "status": "affected",
                "version": "0",
                "versionType": "python"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-9287",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-22T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-23T03:55:30.029Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:33:21.116Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20250425-0006/"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "venv"
          ],
          "product": "CPython",
          "repo": "https://github.com/python/cpython",
          "vendor": "Python Software Foundation",
          "versions": [
            {
              "lessThan": "3.9.21",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            },
            {
              "lessThan": "3.10.16",
              "status": "affected",
              "version": "3.10.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.11.11",
              "status": "affected",
              "version": "3.11.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.12.8",
              "status": "affected",
              "version": "3.12.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.13.1",
              "status": "affected",
              "version": "3.13.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.14.0a2",
              "status": "affected",
              "version": "3.14.0a1",
              "versionType": "python"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment \"activation\" scripts (ie \"source venv/bin/activate\"). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren\u0027t activated before being used (ie \"./venv/bin/python\") are not affected.\u003cbr\u003e"
            }
          ],
          "value": "A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment \"activation\" scripts (ie \"source venv/bin/activate\"). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren\u0027t activated before being used (ie \"./venv/bin/python\") are not affected."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "HIGH",
            "providerUrgency": "GREEN",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/U:Green",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-428",
              "description": "CWE-428 Unquoted Search Path or Element",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-31T19:55:27.648Z",
        "orgId": "28c92f92-d60d-412d-b760-e73465c3df22",
        "shortName": "PSF"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/python/cpython/issues/124651"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/pull/124712"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/RSPJ2B5JL22FG3TKUJ7D7DQ4N5JRRBZL/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/e52095a0c1005a87eed2276af7a1f2f66e2b6483"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/633555735a023d3e4d92ba31da35b1205f9ecbd7"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/8450b2482586857d689b6658f08de9c8179af7db"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/9286ab3a107ea41bd3f3c3682ce2512692bdded8"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/ae961ae94bf19c8f8c7fbea3d1c25cc55ce8ae97"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/d48cc82ed25e26b02eb97c6263d95dcaa1e9111b"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Virtual environment (venv) activation scripts don\u0027t quote paths",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22",
    "assignerShortName": "PSF",
    "cveId": "CVE-2024-9287",
    "datePublished": "2024-10-22T16:34:39.210Z",
    "dateReserved": "2024-09-27T14:48:44.181Z",
    "dateUpdated": "2025-11-03T22:33:21.116Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-0938 (GCVE-0-2025-0938)

Vulnerability from cvelistv5 – Published: 2025-01-31 17:51 – Updated: 2026-07-31 14:05

Title

URL parser allowed square brackets in domain names

Summary

The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential parsing across the Python URL parser and other specification-compliant URL parsers.

Severity

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-01-31 18:50 UTC

CWE

CWE-20 - Improper Input Validation

Assigner

PSF mitre root

References

11 references

URL	Tags
https://github.com/python/cpython/issues/105704	issue-tracking
https://github.com/python/cpython/pull/129418	patch
https://mail.python.org/archives/list/security-an…	vendor-advisory
https://github.com/python/cpython/commit/d89a5f6a…	patch
https://github.com/python/cpython/commit/90e526ae…	patch
https://github.com/python/cpython/commit/a7084f60…	patch
https://github.com/python/cpython/commit/526617ed…	patch
https://github.com/python/cpython/commit/b8b4b713…	patch
https://github.com/python/cpython/commit/ff4e5c25…	patch
https://security.netapp.com/advisory/ntap-2025031…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

1 product

Vendor	Product	Version
Python Software Foundation	CPython	Affected: 0 , < 3.9.22 (python) Affected: 3.10.0 , < 3.10.17 (python) Affected: 3.11.0 , < 3.11.12 (python) Affected: 3.12.0 , < 3.12.9 (python) Affected: 3.13.0 , < 3.13.2 (python) Affected: 3.14.0a1 , < 3.14.0a5 (python)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-0938",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-31T18:50:16.654297Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-31T18:50:29.327Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:56:43.285Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20250314-0002/"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "CPython",
          "repo": "https://github.com/python/cpython",
          "vendor": "Python Software Foundation",
          "versions": [
            {
              "lessThan": "3.9.22",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            },
            {
              "lessThan": "3.10.17",
              "status": "affected",
              "version": "3.10.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.11.12",
              "status": "affected",
              "version": "3.11.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.12.9",
              "status": "affected",
              "version": "3.12.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.13.2",
              "status": "affected",
              "version": "3.13.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.14.0a5",
              "status": "affected",
              "version": "3.14.0a1",
              "versionType": "python"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn\u0027t valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential parsing across the Python URL parser and other specification-compliant URL parsers.\u003cbr\u003e"
            }
          ],
          "value": "The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn\u0027t valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential parsing across the Python URL parser and other specification-compliant URL parsers."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-31T14:05:21.438Z",
        "orgId": "28c92f92-d60d-412d-b760-e73465c3df22",
        "shortName": "PSF"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/python/cpython/issues/105704"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/pull/129418"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/K4EUG6EKV6JYFIC24BASYOZS4M5XOQIB/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/d89a5f6a6e65511a5f6e0618c4c30a7aa5aba56a"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/90e526ae67b172ed7c6c56e7edad36263b0f9403"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/a7084f6075c9595ba60119ce8c62f1496f50c568"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/526617ed68cde460236c973e5d0a8bad4de896ba"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/b8b4b713c5f8ec0958c7ef8d29d6711889bc94ab"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/ff4e5c25666f63544071a6b075ae8b25c98b7a32"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "URL parser allowed square brackets in domain names",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22",
    "assignerShortName": "PSF",
    "cveId": "CVE-2025-0938",
    "datePublished": "2025-01-31T17:51:35.898Z",
    "dateReserved": "2025-01-31T17:45:10.107Z",
    "dateUpdated": "2026-07-31T14:05:21.438Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-4138 (GCVE-0-2025-4138)

Vulnerability from cvelistv5 – Published: 2025-06-03 12:59 – Updated: 2026-07-31 14:03

Title

Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory

Summary

Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more information. Note that for Python 3.14 or later the default value of filter= changed from "no filtering" to `"data", so if you are relying on this new default behavior then your usage is also affected. Note that none of these vulnerabilities significantly affect the installation of source distributions which are tar archives as source distributions already allow arbitrary code execution during the build process. However when evaluating source distributions it's important to avoid installing source distributions with suspicious links.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-06-03 13:29 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

PSF mitre root

References

12 references

URL	Tags
https://github.com/python/cpython/issues/135034	issue-tracking
https://github.com/python/cpython/pull/135037	patch
https://mail.python.org/archives/list/security-an…	vendor-advisory
https://github.com/python/cpython/commit/3612d8f5…	patch
https://github.com/python/cpython/commit/9e0ac76d…	patch
https://gist.github.com/sethmlarson/52398e33eff26…	mitigation
https://github.com/python/cpython/commit/19de092d…	patch
https://github.com/python/cpython/commit/aa9eb5f7…	patch
https://github.com/python/cpython/commit/28463dba…	patch
https://github.com/python/cpython/commit/4633f3f4…	patch
https://github.com/python/cpython/commit/9c1110ef…	patch
https://github.com/python/cpython/commit/dd8f187d…	patch

Impacted products

1 product

Vendor	Product	Version
Python Software Foundation	CPython	Affected: 0 , < 3.9.23 (python) Affected: 3.10.0 , < 3.10.18 (python) Affected: 3.11.0 , < 3.11.13 (python) Affected: 3.12.0 , < 3.12.11 (python) Affected: 3.13.0 , < 3.13.4 (python) Affected: 3.14.0a1 , < 3.14.0b3 (python)

Credits

Caleb Brown (Google) Petr Viktorin Serhiy Storchaka Hugo van Kemenade Łukasz Langa Thomas Wouters Seth Larson

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-4138",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-03T13:29:22.889454Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-03T13:29:36.599Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "tarfile"
          ],
          "product": "CPython",
          "repo": "https://github.com/python/cpython",
          "vendor": "Python Software Foundation",
          "versions": [
            {
              "lessThan": "3.9.23",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            },
            {
              "lessThan": "3.10.18",
              "status": "affected",
              "version": "3.10.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.11.13",
              "status": "affected",
              "version": "3.11.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.12.11",
              "status": "affected",
              "version": "3.12.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.13.4",
              "status": "affected",
              "version": "3.13.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.14.0b3",
              "status": "affected",
              "version": "3.14.0a1",
              "versionType": "python"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Caleb Brown (Google)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Petr Viktorin"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Serhiy Storchaka"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Hugo van Kemenade"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "\u0141ukasz Langa"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Thomas Wouters"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Seth Larson"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eAllows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata.\u003c/span\u003e\u003cbr\u003e\u003c/p\u003e\u003cp\u003eYou are affected by this vulnerability if using the \u003ccode\u003etarfile\u003c/code\u003e\u0026nbsp;module to extract untrusted tar archives using \u003ccode\u003eTarFile.extractall()\u003c/code\u003e\u0026nbsp;or \u003ccode\u003eTarFile.extract()\u003c/code\u003e\u0026nbsp;using the \u003ccode\u003efilter=\u003c/code\u003e\u0026nbsp;parameter with a value of \u003ccode\u003e\"data\"\u003c/code\u003e\u0026nbsp;or \u003ccode\u003e\"tar\"\u003c/code\u003e. See the tarfile \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter\"\u003eextraction filters documentation\u003c/a\u003e\u0026nbsp;for more information.\u003c/p\u003e\u003cp\u003e\u003cspan style=\"background-color: var(--wht);\"\u003eNote that for Python 3.14 or later the default value of \u003c/span\u003e\u003ccode\u003efilter=\u003c/code\u003e\u003cspan style=\"background-color: var(--wht);\"\u003e\u0026nbsp;changed from \"no filtering\" to `\"data\", so if you are relying on this new default behavior then your usage is also affected.\u003c/span\u003e\u003c/p\u003e\u003cp\u003eNote that none of these vulnerabilities significantly affect the installation of source distributions which are tar archives as source distributions already allow arbitrary code execution during the build process. However when evaluating source distributions it\u0027s important to avoid installing source distributions with suspicious links.\u003cbr\u003e\u003c/p\u003e"
            }
          ],
          "value": "Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata.\n\n\nYou are affected by this vulnerability if using the tarfile\u00a0module to extract untrusted tar archives using TarFile.extractall()\u00a0or TarFile.extract()\u00a0using the filter=\u00a0parameter with a value of \"data\"\u00a0or \"tar\". See the tarfile  extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter \u00a0for more information.\n\nNote that for Python 3.14 or later the default value of filter=\u00a0changed from \"no filtering\" to `\"data\", so if you are relying on this new default behavior then your usage is also affected.\n\nNote that none of these vulnerabilities significantly affect the installation of source distributions which are tar archives as source distributions already allow arbitrary code execution during the build process. However when evaluating source distributions it\u0027s important to avoid installing source distributions with suspicious links."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-31T14:03:14.616Z",
        "orgId": "28c92f92-d60d-412d-b760-e73465c3df22",
        "shortName": "PSF"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/python/cpython/issues/135034"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/pull/135037"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/MAXIJJCUUMCL7ATZNDVEGGHUMQMUUKLG/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/3612d8f51741b11f36f8fb0494d79086bac9390a"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/9e0ac76d96cf80b49055f6d6b9a6763fb9215c2a"
        },
        {
          "tags": [
            "mitigation"
          ],
          "url": "https://gist.github.com/sethmlarson/52398e33eff261329a0180ac1d54f42f"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/19de092debb3d7e832e5672cc2f7b788d35951da"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/aa9eb5f757ceff461e6e996f12c89e5d9b583b01"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/28463dba112af719df1e8b0391c46787ad756dd9"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/4633f3f497b1ff70e4a35b6fe2c907cbe2d4cb2e"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/9c1110ef6652687d7c55f590f909720eddde965a"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/dd8f187d0746da151e0025c51680979ac5b4cfb1"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22",
    "assignerShortName": "PSF",
    "cveId": "CVE-2025-4138",
    "datePublished": "2025-06-03T12:59:02.717Z",
    "dateReserved": "2025-04-30T13:35:55.675Z",
    "dateUpdated": "2026-07-31T14:03:14.616Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-4330 (GCVE-0-2025-4330)

Vulnerability from cvelistv5 – Published: 2025-06-03 12:58 – Updated: 2026-08-04 14:27

Title

Extraction filter bypass for linking outside extraction directory

Summary

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-06-03 13:27 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

PSF mitre root

References

12 references

URL	Tags
https://github.com/python/cpython/issues/135034	issue-tracking
https://github.com/python/cpython/pull/135037	patch
https://mail.python.org/archives/list/security-an…	vendor-advisory
https://github.com/python/cpython/commit/3612d8f5…	patch
https://github.com/python/cpython/commit/9e0ac76d…	patch
https://gist.github.com/sethmlarson/52398e33eff26…	mitigation
https://github.com/python/cpython/commit/19de092d…	patch
https://github.com/python/cpython/commit/aa9eb5f7…	patch
https://github.com/python/cpython/commit/28463dba…	patch
https://github.com/python/cpython/commit/4633f3f4…	patch
https://github.com/python/cpython/commit/9c1110ef…	patch
https://github.com/python/cpython/commit/dd8f187d…	patch

Impacted products

1 product

Vendor	Product	Version
Python Software Foundation	CPython	Affected: 0 , < 3.9.23 (python) Affected: 3.10.0 , < 3.10.18 (python) Affected: 3.11.0 , < 3.11.13 (python) Affected: 3.12.0 , < 3.12.11 (python) Affected: 3.13.0 , < 3.13.4 (python) Affected: 3.14.0a1 , < 3.14.0b3 (python)

Credits

Caleb Brown (Google) Petr Viktorin Serhiy Storchaka Hugo van Kemenade Łukasz Langa Thomas Wouters Seth Larson

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-4330",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-03T13:27:07.778910Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-04T14:27:14.209Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "tarfile"
          ],
          "product": "CPython",
          "repo": "https://github.com/python/cpython",
          "vendor": "Python Software Foundation",
          "versions": [
            {
              "lessThan": "3.9.23",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            },
            {
              "lessThan": "3.10.18",
              "status": "affected",
              "version": "3.10.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.11.13",
              "status": "affected",
              "version": "3.11.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.12.11",
              "status": "affected",
              "version": "3.12.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.13.4",
              "status": "affected",
              "version": "3.13.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.14.0b3",
              "status": "affected",
              "version": "3.14.0a1",
              "versionType": "python"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Caleb Brown (Google)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Petr Viktorin"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Serhiy Storchaka"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Hugo van Kemenade"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "\u0141ukasz Langa"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Thomas Wouters"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Seth Larson"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eAllows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata.\u003c/span\u003e\u003cbr\u003e\u003c/p\u003e\u003cp\u003eYou are affected by this vulnerability if using the \u003ccode\u003etarfile\u003c/code\u003e\u0026nbsp;module to extract untrusted tar archives using \u003ccode\u003eTarFile.extractall()\u003c/code\u003e\u0026nbsp;or \u003ccode\u003eTarFile.extract()\u003c/code\u003e\u0026nbsp;using the \u003ccode\u003efilter=\u003c/code\u003e\u0026nbsp;parameter with a value of \u003ccode\u003e\"data\"\u003c/code\u003e\u0026nbsp;or \u003ccode\u003e\"tar\"\u003c/code\u003e. See the tarfile \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter\"\u003eextraction filters documentation\u003c/a\u003e\u0026nbsp;for more information.\u003c/p\u003e\u003cp\u003eNote that for Python 3.14 or later the default value of \u003ccode\u003efilter=\u003c/code\u003e\u0026nbsp;changed from \"no filtering\" to `\"data\", so if you are relying on this new default behavior then your usage is also affected.\u003c/p\u003e\u003cp\u003eNote that none of these vulnerabilities significantly affect the installation of source distributions which are tar archives as source distributions already allow arbitrary code execution during the build process. However when evaluating source distributions it\u0027s important to avoid installing source distributions with suspicious links.\u003cbr\u003e\u003c/p\u003e\u003cbr\u003e"
            }
          ],
          "value": "Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata.\n\n\nYou are affected by this vulnerability if using the tarfile\u00a0module to extract untrusted tar archives using TarFile.extractall()\u00a0or TarFile.extract()\u00a0using the filter=\u00a0parameter with a value of \"data\"\u00a0or \"tar\". See the tarfile  extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter \u00a0for more information.\n\nNote that for Python 3.14 or later the default value of filter=\u00a0changed from \"no filtering\" to `\"data\", so if you are relying on this new default behavior then your usage is also affected.\n\nNote that none of these vulnerabilities significantly affect the installation of source distributions which are tar archives as source distributions already allow arbitrary code execution during the build process. However when evaluating source distributions it\u0027s important to avoid installing source distributions with suspicious links."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-31T14:02:58.847Z",
        "orgId": "28c92f92-d60d-412d-b760-e73465c3df22",
        "shortName": "PSF"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/python/cpython/issues/135034"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/pull/135037"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/MAXIJJCUUMCL7ATZNDVEGGHUMQMUUKLG/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/3612d8f51741b11f36f8fb0494d79086bac9390a"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/9e0ac76d96cf80b49055f6d6b9a6763fb9215c2a"
        },
        {
          "tags": [
            "mitigation"
          ],
          "url": "https://gist.github.com/sethmlarson/52398e33eff261329a0180ac1d54f42f"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/19de092debb3d7e832e5672cc2f7b788d35951da"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/aa9eb5f757ceff461e6e996f12c89e5d9b583b01"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/28463dba112af719df1e8b0391c46787ad756dd9"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/4633f3f497b1ff70e4a35b6fe2c907cbe2d4cb2e"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/9c1110ef6652687d7c55f590f909720eddde965a"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/dd8f187d0746da151e0025c51680979ac5b4cfb1"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Extraction filter bypass for linking outside extraction directory",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22",
    "assignerShortName": "PSF",
    "cveId": "CVE-2025-4330",
    "datePublished": "2025-06-03T12:58:57.452Z",
    "dateReserved": "2025-05-05T15:05:14.302Z",
    "dateUpdated": "2026-08-04T14:27:14.209Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-4435 (GCVE-0-2025-4435)

Vulnerability from cvelistv5 – Published: 2025-06-03 12:59 – Updated: 2026-07-31 14:02

Title

Tarfile extracts filtered members when errorlevel=0

Summary

When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior is that any filtered members would be skipped and not extracted. However the actual behavior of TarFile.errorlevel = 0 in affected versions is that the member would still be extracted and not skipped.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-06-03 13:58 UTC

CWE

CWE-682 - Incorrect Calculation

Assigner

PSF mitre root

References

11 references

URL	Tags
https://github.com/python/cpython/issues/135034	issue-tracking
https://github.com/python/cpython/pull/135037	patch
https://mail.python.org/archives/list/security-an…	vendor-advisory
https://github.com/python/cpython/commit/3612d8f5…	patch
https://github.com/python/cpython/commit/9e0ac76d…	patch
https://github.com/python/cpython/commit/19de092d…	patch
https://github.com/python/cpython/commit/aa9eb5f7…	patch
https://github.com/python/cpython/commit/28463dba…	patch
https://github.com/python/cpython/commit/4633f3f4…	patch
https://github.com/python/cpython/commit/9c1110ef…	patch
https://github.com/python/cpython/commit/dd8f187d…	patch

Impacted products

1 product

Vendor	Product	Version
Python Software Foundation	CPython	Affected: 0 , < 3.9.23 (python) Affected: 3.10.0 , < 3.10.18 (python) Affected: 3.11.0 , < 3.11.13 (python) Affected: 3.12.0 , < 3.12.11 (python) Affected: 3.13.0 , < 3.13.4 (python) Affected: 3.14.0a1 , < 3.14.0b3 (python)

Credits

Chuck Woodraska Petr Viktorin Serhiy Storchaka Hugo van Kemenade Łukasz Langa Thomas Wouters Seth Larson Matt Prodani

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-4435",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-03T13:58:00.099450Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-682",
                "description": "CWE-682 Incorrect Calculation",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-03T14:34:40.228Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "tarfile"
          ],
          "product": "CPython",
          "repo": "https://github.com/python/cpython",
          "vendor": "Python Software Foundation",
          "versions": [
            {
              "lessThan": "3.9.23",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            },
            {
              "lessThan": "3.10.18",
              "status": "affected",
              "version": "3.10.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.11.13",
              "status": "affected",
              "version": "3.11.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.12.11",
              "status": "affected",
              "version": "3.12.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.13.4",
              "status": "affected",
              "version": "3.13.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.14.0b3",
              "status": "affected",
              "version": "3.14.0a1",
              "versionType": "python"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Chuck Woodraska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Petr Viktorin"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Serhiy Storchaka"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Hugo van Kemenade"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "\u0141ukasz Langa"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Thomas Wouters"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Seth Larson"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Matt Prodani"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eWhen using a \u003c/span\u003e\u003ccode\u003eTarFile.errorlevel = 0\u003c/code\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;and extracting with a filter the documented behavior is that any filtered members would be skipped and not extracted. However the actual behavior of \u003c/span\u003e\u003ccode\u003eTarFile.errorlevel = 0\u003c/code\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;in affected versions is that the member would still be extracted and not skipped.\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "When using a TarFile.errorlevel = 0\u00a0and extracting with a filter the documented behavior is that any filtered members would be skipped and not extracted. However the actual behavior of TarFile.errorlevel = 0\u00a0in affected versions is that the member would still be extracted and not skipped."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-31T14:02:43.230Z",
        "orgId": "28c92f92-d60d-412d-b760-e73465c3df22",
        "shortName": "PSF"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/python/cpython/issues/135034"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/pull/135037"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/MAXIJJCUUMCL7ATZNDVEGGHUMQMUUKLG/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/3612d8f51741b11f36f8fb0494d79086bac9390a"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/9e0ac76d96cf80b49055f6d6b9a6763fb9215c2a"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/19de092debb3d7e832e5672cc2f7b788d35951da"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/aa9eb5f757ceff461e6e996f12c89e5d9b583b01"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/28463dba112af719df1e8b0391c46787ad756dd9"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/4633f3f497b1ff70e4a35b6fe2c907cbe2d4cb2e"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/9c1110ef6652687d7c55f590f909720eddde965a"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/dd8f187d0746da151e0025c51680979ac5b4cfb1"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Tarfile extracts filtered members when errorlevel=0",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22",
    "assignerShortName": "PSF",
    "cveId": "CVE-2025-4435",
    "datePublished": "2025-06-03T12:59:06.792Z",
    "dateReserved": "2025-05-08T15:05:11.874Z",
    "dateUpdated": "2026-07-31T14:02:43.230Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-4516 (GCVE-0-2025-4516)

Vulnerability from cvelistv5 – Published: 2025-05-15 13:29 – Updated: 2026-07-31 14:02

Title

Use-after-free in "unicode_escape" decoder with error handler

Summary

There is an issue in CPython when using `bytes.decode("unicode_escape", error="ignore|replace")`. If you are not using the "unicode_escape" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except catching the DecodeError.

Severity

5.9 (Medium)


                        
                          CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-05-15 14:18 UTC

CWE

CWE-416 - Use After Free

Assigner

PSF mitre root

References

12 references

URL	Tags
https://github.com/python/cpython/issues/133767	issue-tracking
https://github.com/python/cpython/pull/129648	patch
https://mail.python.org/archives/list/security-an…	vendor-advisory
https://github.com/python/cpython/commit/69b4387f…	patch
https://github.com/python/cpython/commit/9f69a586…	patch
https://github.com/python/cpython/commit/4398b788…	patch
https://github.com/python/cpython/commit/6279eb8c…	patch
https://github.com/python/cpython/commit/73b3040f…	patch
https://github.com/python/cpython/commit/8d35fd1b…	patch
https://github.com/python/cpython/commit/ab9893c4…	patch
http://www.openwall.com/lists/oss-security/2025/05/16/4
http://www.openwall.com/lists/oss-security/2025/05/19/1

Impacted products

1 product

Vendor	Product	Version
Python Software Foundation	CPython	Affected: 0 , < 3.9.23 (python) Affected: 3.10.0 , < 3.10.18 (python) Affected: 3.11.0 , < 3.11.13 (python) Affected: 3.12.0 , < 3.12.11 (python) Affected: 3.13.0 , < 3.13.4 (python) Affected: 3.14.0a1 , < 3.14.0b2 (python)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-4516",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-15T14:18:44.612125Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-15T14:18:50.599Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-05-19T10:03:31.542Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/05/16/4"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/05/19/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "CPython",
          "repo": "https://github.com/python/cpython",
          "vendor": "Python Software Foundation",
          "versions": [
            {
              "lessThan": "3.9.23",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            },
            {
              "lessThan": "3.10.18",
              "status": "affected",
              "version": "3.10.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.11.13",
              "status": "affected",
              "version": "3.11.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.12.11",
              "status": "affected",
              "version": "3.12.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.13.4",
              "status": "affected",
              "version": "3.13.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.14.0b2",
              "status": "affected",
              "version": "3.14.0a1",
              "versionType": "python"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "There is an issue in CPython when using `bytes.decode(\"unicode_escape\", error=\"ignore|replace\")`. If you are not using the \"unicode_escape\" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except catching the DecodeError."
            }
          ],
          "value": "There is an issue in CPython when using `bytes.decode(\"unicode_escape\", error=\"ignore|replace\")`. If you are not using the \"unicode_escape\" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except catching the DecodeError."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416 Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-31T14:02:21.178Z",
        "orgId": "28c92f92-d60d-412d-b760-e73465c3df22",
        "shortName": "PSF"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/python/cpython/issues/133767"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/pull/129648"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/L75IPBBTSCYEF56I2M4KIW353BB3AY74/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/69b4387f78f413e8c47572a85b3478c47eba8142"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/9f69a58623bd01349a18ba0c7a9cb1dad6a51e8e"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/4398b788ffc1f954a2c552da285477d42a571292"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/6279eb8c076d89d3739a6edb393e43c7929b429d"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/73b3040f592436385007918887b7e2132aa8431f"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/8d35fd1b34935221aff23a1ab69a429dd156be77"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/ab9893c40609935e0d40a6d2a7307ea51aec598b"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Use-after-free in \"unicode_escape\" decoder with error handler",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22",
    "assignerShortName": "PSF",
    "cveId": "CVE-2025-4516",
    "datePublished": "2025-05-15T13:29:20.126Z",
    "dateReserved": "2025-05-09T14:59:53.878Z",
    "dateUpdated": "2026-07-31T14:02:21.178Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-4517 (GCVE-0-2025-4517)

Vulnerability from cvelistv5 – Published: 2025-06-03 12:58 – Updated: 2026-08-04 14:26

Title

Arbitrary writes via tarfile realpath overflow

Summary

Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data". You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more information. Note that for Python 3.14 or later the default value of filter= changed from "no filtering" to `"data", so if you are relying on this new default behavior then your usage is also affected. Note that none of these vulnerabilities significantly affect the installation of source distributions which are tar archives as source distributions already allow arbitrary code execution during the build process. However when evaluating source distributions it's important to avoid installing source distributions with suspicious links.

Severity

9.4 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-10-24 03:55 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

PSF mitre root

References

12 references

URL	Tags
https://github.com/python/cpython/issues/135034	issue-tracking
https://github.com/python/cpython/pull/135037	patch
https://mail.python.org/archives/list/security-an…	vendor-advisory
https://github.com/python/cpython/commit/3612d8f5…	patch
https://github.com/python/cpython/commit/9e0ac76d…	patch
https://gist.github.com/sethmlarson/52398e33eff26…	mitigation
https://github.com/python/cpython/commit/19de092d…	patch
https://github.com/python/cpython/commit/aa9eb5f7…	patch
https://github.com/python/cpython/commit/28463dba…	patch
https://github.com/python/cpython/commit/4633f3f4…	patch
https://github.com/python/cpython/commit/9c1110ef…	patch
https://github.com/python/cpython/commit/dd8f187d…	patch

Impacted products

1 product

Vendor	Product	Version
Python Software Foundation	CPython	Affected: 0 , < 3.9.23 (python) Affected: 3.10.0 , < 3.10.18 (python) Affected: 3.11.0 , < 3.11.13 (python) Affected: 3.12.0 , < 3.12.11 (python) Affected: 3.13.0 , < 3.13.4 (python) Affected: 3.14.0a1 , < 3.14.0b3 (python)

Credits

Caleb Brown (Google) Petr Viktorin Serhiy Storchaka Hugo van Kemenade Łukasz Langa Thomas Wouters Seth Larson

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-4517",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-24T03:55:18.283911Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-04T14:26:54.922Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "tarfile"
          ],
          "product": "CPython",
          "repo": "https://github.com/python/cpython",
          "vendor": "Python Software Foundation",
          "versions": [
            {
              "lessThan": "3.9.23",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            },
            {
              "lessThan": "3.10.18",
              "status": "affected",
              "version": "3.10.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.11.13",
              "status": "affected",
              "version": "3.11.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.12.11",
              "status": "affected",
              "version": "3.12.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.13.4",
              "status": "affected",
              "version": "3.13.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.14.0b3",
              "status": "affected",
              "version": "3.14.0a1",
              "versionType": "python"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Caleb Brown (Google)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Petr Viktorin"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Serhiy Storchaka"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Hugo van Kemenade"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "\u0141ukasz Langa"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Thomas Wouters"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Seth Larson"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eAllows arbitrary filesystem writes outside the extraction directory during extraction with \u003c/span\u003e\u003ccode\u003efilter=\"data\"\u003c/code\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e.\u003c/span\u003e\u003cbr\u003e\u003c/p\u003e\u003cp\u003eYou are affected by this vulnerability if using the \u003ccode\u003etarfile\u003c/code\u003e\u0026nbsp;module to extract untrusted tar archives using \u003ccode\u003eTarFile.extractall()\u003c/code\u003e\u0026nbsp;or \u003ccode\u003eTarFile.extract()\u003c/code\u003e\u0026nbsp;using the \u003ccode\u003efilter=\u003c/code\u003e\u0026nbsp;parameter with a value of \u003ccode\u003e\"data\"\u003c/code\u003e\u0026nbsp;or \u003ccode\u003e\"tar\"\u003c/code\u003e. See the tarfile \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter\"\u003eextraction filters documentation\u003c/a\u003e\u0026nbsp;for more information.\u003c/p\u003e\u003cp\u003eNote that for Python 3.14 or later the default value of \u003ccode\u003efilter=\u003c/code\u003e\u0026nbsp;changed from \"no filtering\" to `\"data\", so if you are relying on this new default behavior then your usage is also affected.\u003c/p\u003e\u003cp\u003eNote that none of these vulnerabilities significantly affect the installation of source distributions which are tar archives as source distributions already allow arbitrary code execution during the build process. However when evaluating source distributions it\u0027s important to avoid installing source distributions with suspicious links.\u003cbr\u003e\u003c/p\u003e"
            }
          ],
          "value": "Allows arbitrary filesystem writes outside the extraction directory during extraction with filter=\"data\".\n\n\nYou are affected by this vulnerability if using the tarfile\u00a0module to extract untrusted tar archives using TarFile.extractall()\u00a0or TarFile.extract()\u00a0using the filter=\u00a0parameter with a value of \"data\"\u00a0or \"tar\". See the tarfile  extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter \u00a0for more information.\n\nNote that for Python 3.14 or later the default value of filter=\u00a0changed from \"no filtering\" to `\"data\", so if you are relying on this new default behavior then your usage is also affected.\n\nNote that none of these vulnerabilities significantly affect the installation of source distributions which are tar archives as source distributions already allow arbitrary code execution during the build process. However when evaluating source distributions it\u0027s important to avoid installing source distributions with suspicious links."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-31T14:02:02.628Z",
        "orgId": "28c92f92-d60d-412d-b760-e73465c3df22",
        "shortName": "PSF"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/python/cpython/issues/135034"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/pull/135037"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/MAXIJJCUUMCL7ATZNDVEGGHUMQMUUKLG/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/3612d8f51741b11f36f8fb0494d79086bac9390a"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/9e0ac76d96cf80b49055f6d6b9a6763fb9215c2a"
        },
        {
          "tags": [
            "mitigation"
          ],
          "url": "https://gist.github.com/sethmlarson/52398e33eff261329a0180ac1d54f42f"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/19de092debb3d7e832e5672cc2f7b788d35951da"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/aa9eb5f757ceff461e6e996f12c89e5d9b583b01"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/28463dba112af719df1e8b0391c46787ad756dd9"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/4633f3f497b1ff70e4a35b6fe2c907cbe2d4cb2e"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/9c1110ef6652687d7c55f590f909720eddde965a"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/dd8f187d0746da151e0025c51680979ac5b4cfb1"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Arbitrary writes via tarfile realpath overflow",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22",
    "assignerShortName": "PSF",
    "cveId": "CVE-2025-4517",
    "datePublished": "2025-06-03T12:58:50.352Z",
    "dateReserved": "2025-05-09T15:05:07.139Z",
    "dateUpdated": "2026-08-04T14:26:54.922Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-6069 (GCVE-0-2025-6069)

Vulnerability from cvelistv5 – Published: 2025-06-17 13:39 – Updated: 2026-07-31 14:01

Title

HTMLParser quadratic complexity when processing malformed inputs

Summary

The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-06-17 13:58 UTC

CWE

CWE-1333 - Inefficient Regular Expression Complexity

Assigner

PSF mitre root

References

10 references

URL	Tags
https://github.com/python/cpython/issues/135462	issue-tracking
https://github.com/python/cpython/pull/135464	patch
https://github.com/python/cpython/commit/4455cbab…	patch
https://github.com/python/cpython/commit/6eb6c5db…	patch
https://github.com/python/cpython/commit/d851f8e2…	patch
https://mail.python.org/archives/list/security-an…	vendor-advisory
https://github.com/python/cpython/commit/8d1b3dfa…	patch
https://github.com/python/cpython/commit/ab0893fd…	patch
https://github.com/python/cpython/commit/f3c6f882…	patch
https://github.com/python/cpython/commit/fdc9d214…	patch

Impacted products

1 product

Vendor	Product	Version
Python Software Foundation	CPython	Affected: 0 , < 3.9.24 (python) Affected: 3.10.0 , < 3.10.19 (python) Affected: 3.11.0 , < 3.11.14 (python) Affected: 3.12.0 , < 3.12.12 (python) Affected: 3.13.0 , < 3.13.6 (python) Affected: 3.14.0a1 , < 3.14.0b3 (python)

Credits

Serhiy Storchaka Jake Howard sw0rd1ight

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-6069",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-17T13:58:28.646020Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-17T13:58:41.637Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "html.parser"
          ],
          "product": "CPython",
          "repo": "https://github.com/python/cpython",
          "vendor": "Python Software Foundation",
          "versions": [
            {
              "lessThan": "3.9.24",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            },
            {
              "lessThan": "3.10.19",
              "status": "affected",
              "version": "3.10.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.11.14",
              "status": "affected",
              "version": "3.11.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.12.12",
              "status": "affected",
              "version": "3.12.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.13.6",
              "status": "affected",
              "version": "3.13.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.14.0b3",
              "status": "affected",
              "version": "3.14.0a1",
              "versionType": "python"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Serhiy Storchaka"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jake Howard"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "sw0rd1ight"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service."
            }
          ],
          "value": "The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "CWE-1333 Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-31T14:01:47.064Z",
        "orgId": "28c92f92-d60d-412d-b760-e73465c3df22",
        "shortName": "PSF"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/python/cpython/issues/135462"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/pull/135464"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/4455cbabf991e202185a25a631af206f60bbc949"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/6eb6c5dbfb528bd07d77b60fd71fd05d81d45c41"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/d851f8e258c7328814943e923a7df81bca15df4b"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/K5PIYLR6EP3WR7ZOKKYQUWEDNQVUXOYM/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/8d1b3dfa09135affbbf27fb8babcf3c11415df49"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/ab0893fd5c579d9cea30841680e6d35fc478afb5"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/f3c6f882cddc8dc30320d2e73edf019e201394fc"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/fdc9d214c01cb4588f540cfa03726bbf2a33fc15"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "HTMLParser quadratic complexity when processing malformed inputs",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22",
    "assignerShortName": "PSF",
    "cveId": "CVE-2025-6069",
    "datePublished": "2025-06-17T13:39:46.058Z",
    "dateReserved": "2025-06-13T14:05:15.473Z",
    "dateUpdated": "2026-07-31T14:01:47.064Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2025:23530

CVE-2024-11168 (GCVE-0-2024-11168)

CVE-2024-5642 (GCVE-0-2024-5642)

CVE-2024-9287 (GCVE-0-2024-9287)

CVE-2025-0938 (GCVE-0-2025-0938)

CVE-2025-4138 (GCVE-0-2025-4138)

CVE-2025-4330 (GCVE-0-2025-4330)

CVE-2025-4435 (GCVE-0-2025-4435)

CVE-2025-4516 (GCVE-0-2025-4516)

CVE-2025-4517 (GCVE-0-2025-4517)

CVE-2025-6069 (GCVE-0-2025-6069)

Tags

Sightings

Nomenclature

Related by attack behaviour