Summary
It was discovered that Python incorrectly handled certain unicode
characters during decoding. An attacker could possibly use this issue to
cause a denial of service. (CVE-2025-4516)
It was discovered that Python incorrectly handled unicode encoding of email
headers with list separators in folded lines. An attacker could possibly
use this issue to expose sensitive information. (CVE-2025-1795)
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | python3.10 | 3.10.12-1~22.04.10 |
| Ubuntu · 24.04 LTS 24.04:LTS | python3.12 | 3.12.3-1ubuntu0.6 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | python3.6 | 3.6.9-1~18.04ubuntu1.13+esm5 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | python3.7 | 3.7.5-2ubuntu1~18.04.2+esm6 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | python3.8 | 3.8.0-3ubuntu1~18.04.2+esm5 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | python3.8 | 3.8.10-0ubuntu1~20.04.18+esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | python3.9 | 3.9.5-3ubuntu0~20.04.1+esm5 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | python3.11 | 3.11.0~rc1-1~22.04.1~esm4 |
Vulnerabilities 2
-
Medium 5.9
Use-after-free in "unicode_escape" decoder with error handler
There is an issue in CPython when using `bytes.decode("unicode_escape", error="ignore|replace")`. If you are not using the "unicode_escape" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handle…
-
Low 2.3
Mishandling of comma during folding and unicode-encoding of email headers
During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded then the separator itself is also unicode-encoded. Expected behavior is that the separating comma remains a plan comma. This can result in t…