Gentoo Project

Python

Security Bug Reports

• dev-python/pip: Possible code execution via untrusted packages from external indexes (CVE-2018-20225)

  721672 - Assigned to Gentoo Security
• <dev-python/reportlab-3.5.56: SSRF vulnerability (CVE-2020-28463)

  771552 - Assigned to Gentoo Security
• dev-python/ujson: stack-based buffer overflow

  830373 - Assigned to Gentoo Security
• <dev-python/numpy-1.22.2: null pointer dereference

  832736 - Assigned to Gentoo Security
• <dev-python/waitress-2.1.1: multiple "HTTP desync/HTTP request smuggling" vulnerabilities

  835492 - Assigned to Gentoo Security
• dev-python/nbconvert: arbitrary html injection

  865721 - Assigned to Gentoo Security
• <dev-python/oslo-utils-4.12.1: plaintext logging of certain passwords

  867328 - Assigned to Gentoo Security
• <dev-python/py-1.11.0-r2: ReDoS via subversion repository with crafted info

  877455 - Assigned to Gentoo Security
• <dev-python/werkzeug-2.2.3: DoS via multipart form upload

  897962 - Assigned to Gentoo Security
• <dev-python/tornado-6.3.2: open redirect vulnerability

  906519 - Assigned to Gentoo Security
• <dev-python/reportlab-3.6.13: remote code execution

  907924 - Assigned to Gentoo Security
• <dev-python/starlette-0.27.0: local file inclusion vulnerability

  907929 - Assigned to Gentoo Security
• <dev-python/mechanicalsoup-1.3.0: Malicious web server can read arbitrary files on client using file input inside HTML form

  909723 - Assigned to Gentoo Security
• <dev-python/pypdf-3.17.0: multiple vulnerabilities

  918441 - Assigned to Gentoo Security
• <dev-python/twisted-23.10.0_rc1: response ordering vulnerability

  918526 - Assigned to Gentoo Security
• <dev-python/paramiko-3.4.0: terrapin vulnerability

  920299 - Assigned to Gentoo Security
• <dev-python/pycryptodome-3.19.1: side-channel leakage with OAEP decryption

  920912 - Assigned to Gentoo Security
• <dev-python/jinja2-3.1.3: HTML attribute injection when passing user input as keys to xmlattr filter

  921734 - Assigned to Gentoo Security
• <dev-python/flask-cors-4.0.1: log injection when the log level is set to debug

  931228 - Assigned to Gentoo Security
• <dev-python/requests-2.32.0: Session object does not verify requests after making first request with verify=False

  932327 - Assigned to Gentoo Security
• <dev-python/pymysql-1.1.1: SQL injection if used with untrusted JSON input

  932396 - Assigned to Gentoo Security
• <dev-python/webob-1.8.8: Location header normalization during redirect leads to open redirect

  937946 - Assigned to Gentoo Security
• <dev-python/configobj-5.0.9: ReDoS via the validate function

  940017 - Assigned to Gentoo Security
• <dev-python/werkzeug-3.0.6, <dev-python/quart-0.19.7: possible resource exhaustion when parsing file data in forms

  942200 - Assigned to Gentoo Security
• <dev-python/tornado-6.4.2: ReDoS in cookie parsing

  944393 - Assigned to Gentoo Security
• <dev-python/python-jose-3.4.0: multiple vulnerabilities

  949740 - Assigned to Gentoo Security
• <dev-python/requests-2.32.4: Netrc credential leak

  957111 - Assigned to Gentoo Security
• <dev-python/deepdiff-8.6.1: DoS/RCE in the Delta class which was vulnerable to class pollution via its constructor

  962330 - Assigned to Gentoo Security
• <dev-python/django-5.2.7: multiple vulnerabilities

  963675 - Assigned to Gentoo Security
• <dev-python/python-ldap-3.4.5: multiple vulnerabilities

  964025 - Assigned to Gentoo Security
• <dev-python/uv-0.9.6: Differential in tar extraction with PAX headers

  965151 - Assigned to Gentoo Security
• <dev-python/starlette-0.49.1: DoS via Range header merging

  965316 - Assigned to Gentoo Security
• <dev-python/cryptography-46.0.5: Private key material could be revealed via crafted public key

  969883 - Assigned to Gentoo Security
• <dev-python/pillow-12.1.1: OOB write with invalid tile extents

  969998 - Assigned to Gentoo Security
• <dev-python/django-{4.2.29,5.2.12,6.0.3}: Potential incorrect permissions on newly created file system objects

  970871 - Assigned to Gentoo Security
• dev-lang/python: SourcelessFileLoader does not use io.open_code()

  970945 - Assigned to Gentoo Security
• <dev-python/tornado-6.5.5: multiple vulnerabilities

  971136 - Assigned to Gentoo Security
• <dev-python/pyasn1-0.6.3: stack overflow on parsing deeply nested ASN.1 structures

  971278 - Assigned to Gentoo Security
• <dev-python/deepdiff-8.6.2: memory exhaustion DoS vulnerability in `_RestrictedUnpickler`

  971353 - Assigned to Gentoo Security
• <dev-python/requests-2.33.0: malicious file replacement via improper use of requests.utils.extract_zipped_paths() [unlikely]

  971573 - Assigned to Gentoo Security
• <dev-python/cryptography-46.0.6: name constraints not applied to peer names during verification when the leaf certificate contains a wildcard DNS SAN

  971574 - Assigned to Gentoo Security
• <dev-python/nbconvert-7.17.1: multiple vulnerabilities

  972419 - Assigned to Gentoo Security
• <dev-python/cryptography-46.0.7: buffer overflow via non-contiguous buffers

  972446 - Assigned to Gentoo Security
• dev-python/diskcache: unsafe pickle deserialization (local code execution)

  972631 - Assigned to Gentoo Security
• <dev-python/pymysql-1.1.3: possible SQL injection in `Cursor.callproc()`

  973489 - Assigned to Gentoo Security
• <dev-python/idna-3.14: bypass of CVE-2024-3651 mitigation

  974510 - Assigned to Gentoo Security
• <app-arch/brotli-1.2.0-r2: out-of-bounds write permits remote code execution

  984677 - Assigned to Gentoo Security