Skip to content
OpenAdvisories

Vendor

Python Software Foundation

81 known vulnerabilities.

Products

CPython 80 pymanager 1
All Critical High Medium Low Exploited only Public exploit

43 results · Clear filters · Feed

  • Medium 6.5
    CVE-2024-5642

    Buffer overread when using an empty list with SSLContext.set_npn_protocols()

    CPython 3.9 and earlier doesn't disallow configuring an empty list ("[]") for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vu…

    Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu
  • Medium 6.2
    CVE-2024-0450

    Quoted zip-bomb protection for zipfile

    An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The zipfile module is vulnerable to “quoted-overlap” zip-bombs which exploit the zip format to create a zip-bomb with a high compressi…

    Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Alpine
  • Medium 6.1
    CVE-2023-6507

    Groups not dropped before running subprocess when using empty 'extra_groups' parameter

    An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases. When using the `extra_groups=` parameter with an empty list as a value (ie `extra_groups=[]`) the log…

    Python Software Foundation CPython