Summary
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Security Fix(es):
* python: Invalid value for OpenSSL API may cause Buffer over-read when NPN is used (CVE-2024-5642)
* python: Virtual environment (venv) activation scripts don't quote paths (CVE-2024-9287)
* python: Improper validation of IPv6 and IPvFuture addresses (CVE-2024-11168)
* python: cpython: URL parser allowed square brackets in domain names (CVE-2025-0938)
* cpython: python: CPython DecodeError Handling Vulnerability (CVE-2025-4516)
* cpython: Tarfile extracts filtered members when errorlevel=0 (CVE-2025-4435)
* cpython: python: Extraction filter bypass for linking outside extraction directory (CVE-2025-4330)
* python: cpython: Arbitrary writes via tarfile realpath overflow (CVE-2025-4517)
* cpython: python: Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory (CVE-2025-4138)
* cpython: Python HTMLParser quadratic complexity (CVE-2025-6069)
* cpython: python: Python zipfile End of Central Directory (EOCD) Locator record offset not checked (CVE-2025-8291)
* python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 67
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 8 | Cython | 0:0.29.21-5.module+el8.10.0+1860+afcc1c71 |
| Rocky Linux · 8 | Cython | 0:0.29.21-5.module+el8.10.0+1582+bc278001 |
| Rocky Linux · 8 | mod_wsgi | 0:4.7.1-7.module+el8.10.0+1978+d4f111ba.1 |
| Rocky Linux · 8 | mod_wsgi | 0:4.7.1-7.module+el8.10.0+1582+bc278001 |
| Rocky Linux · 8 | mod_wsgi | 0:4.7.1-7.module+el8.10.0+1860+afcc1c71 |
| Rocky Linux · 8 | numpy | 0:1.19.4-3.module+el8.10.0+1582+bc278001 |
| Rocky Linux · 8 | numpy | 0:1.19.4-3.module+el8.10.0+1860+afcc1c71 |
| Rocky Linux · 8 | pybind11 | 0:2.7.1-1.module+el8.9.0+1357+a3b80af7 |
| Rocky Linux · 8 | pytest | 0:6.0.2-2.module+el8.10.0+1860+afcc1c71 |
| Rocky Linux · 8 | pytest | 0:6.0.2-2.module+el8.10.0+1582+bc278001 |
| Rocky Linux · 8 | python-attrs | 0:20.3.0-2.module+el8.10.0+1582+bc278001 |
| Rocky Linux · 8 | python-attrs | 0:20.3.0-2.module+el8.10.0+1860+afcc1c71 |
| Rocky Linux · 8 | python-cffi | 0:1.14.3-2.module+el8.10.0+1860+afcc1c71 |
| Rocky Linux · 8 | python-cffi | 0:1.14.3-2.module+el8.10.0+1582+bc278001 |
| Rocky Linux · 8 | python-chardet | 0:3.0.4-19.module+el8.10.0+1582+bc278001 |
| Rocky Linux · 8 | python-chardet | 0:3.0.4-19.module+el8.10.0+1860+afcc1c71 |
| Rocky Linux · 8 | python-chardet | 0:3.0.4-19.module+el8.9.0+1418+f0d66789 |
| Rocky Linux · 8 | python-cryptography | 0:3.3.1-3.module+el8.10.0+1697+7e517775 |
| Rocky Linux · 8 | python-cryptography | 0:3.3.1-3.module+el8.10.0+1860+afcc1c71 |
| Rocky Linux · 8 | python-idna | 0:2.10-4.module+el8.10.0+1860+afcc1c71 |
| Rocky Linux · 8 | python-idna | 0:2.10-4.module+el8.10.0+1809+41195054 |
| Rocky Linux · 8 | python-iniconfig | 0:1.1.1-2.module+el8.9.0+1332+dd574197 |
| Rocky Linux · 8 | python-lxml | 0:4.6.5-1.module+el8.10.0+1582+bc278001 |
| Rocky Linux · 8 | python-more-itertools | 0:8.5.0-2.module+el8.10.0+1582+bc278001 |
| Rocky Linux · 8 | python-more-itertools | 0:8.5.0-2.module+el8.10.0+1860+afcc1c71 |
| Rocky Linux · 8 | python-packaging | 0:20.4-4.module+el8.10.0+1860+afcc1c71 |
| Rocky Linux · 8 | python-packaging | 0:20.4-4.module+el8.10.0+1582+bc278001 |
| Rocky Linux · 8 | python-pluggy | 0:0.13.1-3.module+el8.10.0+1582+bc278001 |
| Rocky Linux · 8 | python-pluggy | 0:0.13.1-3.module+el8.10.0+1860+afcc1c71 |
| Rocky Linux · 8 | python-ply | 0:3.11-10.module+el8.9.0+1418+f0d66789 |
| Rocky Linux · 8 | python-ply | 0:3.11-10.module+el8.10.0+1582+bc278001 |
| Rocky Linux · 8 | python-ply | 0:3.11-10.module+el8.10.0+1860+afcc1c71 |
| Rocky Linux · 8 | python-psutil | 0:5.8.0-4.module+el8.9.0+1357+a3b80af7 |
| Rocky Linux · 8 | python-psycopg2 | 0:2.8.6-3.module+el8.10.0+1660+b5b6f004 |
| Rocky Linux · 8 | python-psycopg2 | 0:2.8.6-3.module+el8.10.0+1860+afcc1c71 |
| Rocky Linux · 8 | python-py | 0:1.10.0-1.module+el8.10.0+1860+afcc1c71 |
| Rocky Linux · 8 | python-py | 0:1.10.0-1.module+el8.10.0+1582+bc278001 |
| Rocky Linux · 8 | python-pycparser | 0:2.20-3.module+el8.10.0+1582+bc278001 |
| Rocky Linux · 8 | python-pycparser | 0:2.20-3.module+el8.10.0+1860+afcc1c71 |
| Rocky Linux · 8 | python-PyMySQL | 0:0.10.1-2.module+el8.10.0+1910+234ad790 |
| Rocky Linux · 8 | python-PyMySQL | 0:0.10.1-2.module+el8.10.0+1592+61442852 |
| Rocky Linux · 8 | python-PyMySQL | 0:0.10.1-2.module+el8.10.0+1860+afcc1c71 |
| Rocky Linux · 8 | python-PyMySQL | 0:0.10.1-2.module+el8.10.0+1582+bc278001 |
| Rocky Linux · 8 | python-pysocks | 0:1.7.1-4.module+el8.9.0+1418+f0d66789 |
| Rocky Linux · 8 | python-pysocks | 0:1.7.1-4.module+el8.10.0+1582+bc278001 |
| Rocky Linux · 8 | python-pysocks | 0:1.7.1-4.module+el8.10.0+1860+afcc1c71 |
| Rocky Linux · 8 | python-requests | 0:2.25.0-3.module+el8.10.0+1860+afcc1c71 |
| Rocky Linux · 8 | python-requests | 0:2.25.0-3.module+el8.10.0+1582+bc278001 |
| Rocky Linux · 8 | python-toml | 0:0.10.1-5.module+el8.9.0+1332+dd574197 |
| Rocky Linux · 8 | python-urllib3 | 0:1.25.10-5.module+el8.10.0+1860+afcc1c71 |
| Rocky Linux · 8 | python-urllib3 | 0:1.25.10-5.module+el8.10.0+1545+03246da9 |
| Rocky Linux · 8 | python-wcwidth | 0:0.2.5-3.module+el8.10.0+1860+afcc1c71 |
| Rocky Linux · 8 | python-wcwidth | 0:0.2.5-3.module+el8.10.0+1582+bc278001 |
| Rocky Linux · 8 | python-wheel | 1:0.35.1-4.module+el8.10.0+1582+bc278001 |
| Rocky Linux · 8 | python-wheel | 1:0.35.1-4.module+el8.10.0+1860+afcc1c71 |
| Rocky Linux · 8 | python3x-pip | 0:20.2.4-9.module+el8.10.0+1721+e52d6351 |
| Rocky Linux · 8 | python3x-pip | 0:20.2.4-9.module+el8.10.0+1860+afcc1c71 |
| Rocky Linux · 8 | python3x-pyparsing | 0:2.4.7-5.module+el8.10.0+1860+afcc1c71 |
| Rocky Linux · 8 | python3x-pyparsing | 0:2.4.7-5.module+el8.10.0+1582+bc278001 |
| Rocky Linux · 8 | python3x-setuptools | 0:50.3.2-7.module+el8.10.0+2057+30213a2b |
| Rocky Linux · 8 | python3x-six | 0:1.15.0-3.module+el8.10.0+1582+bc278001 |
| Rocky Linux · 8 | python3x-six | 0:1.15.0-3.module+el8.10.0+1860+afcc1c71 |
| Rocky Linux · 8 | PyYAML | 0:5.4.1-1.module+el8.10.0+1860+afcc1c71 |
| Rocky Linux · 8 | PyYAML | 0:5.4.1-1.module+el8.9.0+1418+f0d66789 |
| Rocky Linux · 8 | PyYAML | 0:5.4.1-1.module+el8.10.0+1582+bc278001 |
| Rocky Linux · 8 | scipy | 0:1.5.4-5.module+el8.10.0+1860+afcc1c71 |
| Rocky Linux · 8 | scipy | 0:1.5.4-5.module+el8.10.0+1582+bc278001 |
Vulnerabilities 12
-
Critical 9.4CVE-2025-4517 Public exploit
Arbitrary writes via tarfile realpath overflow
Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data". You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() usin…
-
High 7.5CVE-2025-4138 Public exploit
Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory
Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives u…
-
High 7.5
Extraction filter bypass for linking outside extraction directory
Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives u…
-
High 7.5
Tarfile extracts filtered members when errorlevel=0
When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior is that any filtered members would be skipped and not extracted. However the actual behavior of TarFile.errorlevel = 0 in affected versions is that the member would still…
-
Medium 6.5
Buffer overread when using an empty list with SSLContext.set_npn_protocols()
CPython 3.9 and earlier doesn't disallow configuring an empty list ("[]") for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vu…
-
Medium 6.3
Improper validation of IPv6 and IPvFuture addresses
The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one U…
-
Medium 6.3
URL parser allowed square brackets in domain names
The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture…
-
Medium 5.9
Use-after-free in "unicode_escape" decoder with error handler
There is an issue in CPython when using `bytes.decode("unicode_escape", error="ignore|replace")`. If you are not using the "unicode_escape" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handle…
-
Medium 5.3
Virtual environment (venv) activation scripts don't quote paths
A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/…
-
Medium 4.3
HTMLParser quadratic complexity when processing malformed inputs
The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service.
-
Medium 4.3
ZIP64 End of Central Directory (EOCD) Locator record offset not checked
The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be assumed to be the previous record in the ZIP a…
-
Low 1.8
Quadratic complexity in os.path.expandvars() with user-controlled template
If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2294682
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2321440
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2325776
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2343237
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2366509
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2370010
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2370014
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2370016
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2372426
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2373234
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2402342
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2408891