Уязвимость модуля email интерпретатора языка программирования Python, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании

Уязвимость функций urllib.parse.urlsplit() и urlparse() интерпретатора языка программирования Python, позволяющая нарушителю повысить свои привилегии

Уязвимость функций extract и extractall модуля tarfile интерпретатора языка программирования Python, позволяющая нарушителю выполнить произвольный код

Уязвимость компонента urllib интерпретатора языка программирования Python, позволяющая нарушителю вызвать отказ в обслуживании

Security update for python

Security update for python3

Security update for python3

Security update for python36

Security update for python

Recommended update for python3

Important: python39:3.9 and python39-devel:3.9 security update

Important: python38:3.8 and python38-devel:3.8 security update

Important: python27:2.7 security update

Important: python3.9 security update

Important: python3.11 security update

Important: python3 security update

Important: python3.11 security update

An issue in the urllib.parse component of Python before v3.11 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.

An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally.

Multiple integer overflows in the XML_GetBuffer function in Expat through 2.1.0, as used in Google Chrome before 44.0.2403.89 and other products, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted XML data, a related issue to CVE-2015-2716.