Summary
It was discovered that Python inefficiently handled expanding system
environment variables. An attacker could possibly use this issue to cause
Python to consume excessive resources, leading to a denial of service.
(CVE-2025-6075)
Caleb Brown discovered that Python incorrectly handled the ZIP64 End of
Central Directory (EOCD) Locator record offset value. An attacker could
possibly use this issue to obfuscate malicious content. (CVE-2025-8291)
Fixed packages 11
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | python3.10 | 3.10.12-1~22.04.12 |
| Ubuntu · 24.04 LTS 24.04:LTS | python3.12 | 3.12.3-1ubuntu0.9 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | python3.4 | 3.4.3-1ubuntu1~14.04.7+esm17 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | python3.5 | 3.5.2-2ubuntu0~16.04.4~14.04.1+esm8 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | python3.5 | 3.5.2-2ubuntu0~16.04.13+esm20 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | python3.6 | 3.6.9-1~18.04ubuntu1.13+esm7 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | python3.7 | 3.7.5-2ubuntu1~18.04.2+esm8 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | python3.8 | 3.8.0-3ubuntu1~18.04.2+esm7 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | python3.8 | 3.8.10-0ubuntu1~20.04.18+esm3 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | python3.9 | 3.9.5-3ubuntu0~20.04.1+esm7 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | python3.11 | 3.11.0~rc1-1~22.04.1~esm6 |
Vulnerabilities 2
-
Medium 4.3
ZIP64 End of Central Directory (EOCD) Locator record offset not checked
The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be assumed to be the previous record in the ZIP a…
-
Low 1.8
Quadratic complexity in os.path.expandvars() with user-controlled template
If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.