4 results · Feed
-
Medium 5.3
socket.getaddrinfo() accepts embedded null bytes in host and port
socket.getaddrinfo() previously accepted null bytes within *host* and *port* parameters which can cause the values to be silently truncated.
-
Low 2.0
Lenient parsing of integers for response body and chunk framing
Response body and chunk parsing would handle non-hex or negative integers incorrectly which could result in misinterpreting HTTP response contents.
-
Critical 9.4
Distrust compromised intermediate certificates in ssl module
Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configur…
-
Medium 6.9
tar filter allows writing outside destination via empty-named symlink
tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extracta…