https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 15:29:08 +0000 https://cve.radiocsirt.org/vuln/alsa-2020:4641 <p><strong>Affected:</strong> AlmaLinux:8: python38-Cython, AlmaLinux:8: python38-asn1crypto, AlmaLinux:8: python38-cffi, AlmaLinux:8: python38-chardet, AlmaLinux:8: python38-cryptography, AlmaLinux:8: python38-idna, AlmaLinux:8: python38-markupsafe, AlmaLinux:8: python38-mod_wsgi, AlmaLinux:8: python38-psycopg2, AlmaLinux:8: python38-psycopg2-doc and 6 more</p> <p>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.</p> <p>The following packages have been upgraded to a later upstream version: python38 (3.8.3). (BZ#1847416)</p> <p>Security Fix(es):</p> <p>* PyYAML: command execution through python/object/apply constructor in FullLoader (CVE-2019-20477)</p> <p>* python: infinite loop in the tarfile module via crafted TAR archive (CVE-2019-20907)</p> <p>* PyYAML: arbitrary command execution through python/object/new when FullLoader is used (CVE-2020-1747)</p> <p>* python: wrong backtracking in urllib.request.AbstractBasicAuthHandler allows for a ReDoS (CVE-2020-8492)</p> <p>* python: DoS via inefficiency in IPv{4,6}Interface classes (CVE-2020-14422)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p>Additional Changes:</p> <p>For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.</p> <p><strong>Affected:</strong> AlmaLinux:8: python38-Cython, AlmaLinux:8: python38-asn1crypto, AlmaLinux:8: python38-cffi, AlmaLinux:8: python38-chardet, AlmaLinux:8: python38-cryptography, AlmaLinux:8: python38-idna, AlmaLinux:8: python38-markupsafe, AlmaLinux:8: python38-mod_wsgi, AlmaLinux:8: python38-psycopg2, AlmaLinux:8: python38-psycopg2-doc and 6 more</p> <p>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.</p> <p>The following packages have been upgraded to a later upstream version: python38 (3.8.3). (BZ#1847416)</p> <p>Security Fix(es):</p> <p>* PyYAML: command execution through python/object/apply constructor in FullLoader (CVE-2019-20477)</p> <p>* python: infinite loop in the tarfile module via crafted TAR archive (CVE-2019-20907)</p> <p>* PyYAML: arbitrary command execution through python/object/new when FullLoader is used (CVE-2020-1747)</p> <p>* python: wrong backtracking in urllib.request.AbstractBasicAuthHandler allows for a ReDoS (CVE-2020-8492)</p> <p>* python: DoS via inefficiency in IPv{4,6}Interface classes (CVE-2020-14422)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p>Additional Changes:</p> <p>For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2020:4641 https://cve.radiocsirt.org/vuln/bell-cve-2019-20477 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Withdrawn by the publisher.</strong></p> https://cve.radiocsirt.org/vuln/bell-cve-2019-20477 https://cve.radiocsirt.org/vuln/brew-ansible-cmdb-cve-2019-20477 <p><strong>Affected:</strong> Homebrew: ansible-cmdb</p> <p>PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.</p> <p><strong>Affected:</strong> Homebrew: ansible-cmdb</p> <p>PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.</p> https://cve.radiocsirt.org/vuln/brew-ansible-cmdb-cve-2019-20477 https://cve.radiocsirt.org/vuln/certfr-2022-avi-278 certfr-2022-avi-278 https://cve.radiocsirt.org/vuln/certfr-2022-avi-278 https://cve.radiocsirt.org/vuln/euvd-2026-59954 EUVD-2026-59954 https://cve.radiocsirt.org/vuln/euvd-2026-59954 https://cve.radiocsirt.org/vuln/fkie_cve-2019-20477 <p>PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.</p> <p>PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2019-20477 https://cve.radiocsirt.org/vuln/ghsa-3pqx-4fqf-j49f <p><strong>Affected:</strong> PyPI: pyyaml</p> <p>PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.</p> <p><strong>Affected:</strong> PyPI: pyyaml</p> <p>PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.</p> https://cve.radiocsirt.org/vuln/ghsa-3pqx-4fqf-j49f https://cve.radiocsirt.org/vuln/gsd-2019-20477 gsd-2019-20477 https://cve.radiocsirt.org/vuln/gsd-2019-20477 https://cve.radiocsirt.org/vuln/pysec-2020-176 <p><strong>Affected:</strong> PyPI: pyyaml</p> <p>PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.</p> <p><strong>Affected:</strong> PyPI: pyyaml</p> <p>PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.</p> https://cve.radiocsirt.org/vuln/pysec-2020-176 https://cve.radiocsirt.org/vuln/rhsa-2020:4641 <p>PyYAML: command execution through python/object/apply constructor in FullLoader python: infinite loop in the tarfile module via crafted TAR archive PyYAML: arbitrary command execution through python/object/new when FullLoader is used python: wrong backtracking in urllib.request.AbstractBasicAuthHandler allows for a ReDoS python: DoS via inefficiency in IPv{4,6}Interface classes</p> <p>PyYAML: command execution through python/object/apply constructor in FullLoader python: infinite loop in the tarfile module via crafted TAR archive PyYAML: arbitrary command execution through python/object/new when FullLoader is used python: wrong backtracking in urllib.request.AbstractBasicAuthHandler allows for a ReDoS python: DoS via inefficiency in IPv{4,6}Interface classes</p> https://cve.radiocsirt.org/vuln/rhsa-2020:4641 https://cve.radiocsirt.org/vuln/rhsa-2021:0420 <p>openstack-mistral: information disclosure in mistral log waitress: HTTP request smuggling through LF vs CRLF handling waitress: HTTP request smuggling through invalid Transfer-Encoding waitress: HTTP Request Smuggling through Invalid whitespace characters in headers python-pillow: uncontrolled resource consumption in FpxImagePlugin.py PyYAML: command execution through python/object/apply constructor in FullLoader python-pillow: Integer overflow leading to buffer overflow in ImagingLibTiffDecode python-pillow: out-of-bounds write in expandrow in libImaging/SgiRleDecode.c python-pillow: improperly restricted operations on memory buffer in libImaging/PcxDecode.c python-pillow: out-of-bounds read in ImagingFliDecode when loading FLI images yarn: Arbitrary filesystem write via tar expansion python-pillow: multiple out-of-bounds reads in libImaging/FliDecode.c python-pillow: an out-of-bounds read in libImaging/PcxDecode.c can occur when reading PCX files python-pillow: two buffer overflows in libImaging/TiffDecode.c due to small buffers allocated in ImagingLibTiffDecode() python-pillow: multiple out-of-bounds reads via a crafted JP2 file python-pillow: out-of-bounds reads/writes in the parsing of SGI image files in expandrow/expandrow2 golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash</p> <p>openstack-mistral: information disclosure in mistral log waitress: HTTP request smuggling through LF vs CRLF handling waitress: HTTP request smuggling through invalid Transfer-Encoding waitress: HTTP Request Smuggling through Invalid whitespace characters in headers python-pillow: uncontrolled resource consumption in FpxImagePlugin.py PyYAML: command execution through python/object/apply constructor in FullLoader python-pillow: Integer overflow leading to buffer overflow in ImagingLibTiffDecode python-pillow: out-of-bounds write in expandrow in libImaging/SgiRleDecode.c python-pillow: improperly restricted operations on memory buffer in libImaging/PcxDecode.c python-pillow: out-of-bounds read in ImagingFliDecode when loading FLI images yarn: Arbitrary filesystem write via tar expansion python-pillow: multiple out-of-bounds reads in libImaging/FliDecode.c python-pillow: an out-of-bounds read in libImaging/PcxDecode.c can occur when reading PCX files python-pillow: two buffer overflows in libImaging/TiffDecode.c due to small buffers allocated in ImagingLibTiffDecode() python-pillow: multiple out-of-bounds reads via a crafted JP2 file python-pillow: out-of-bounds reads/writes in the parsing of SGI image files in expandrow/expandrow2 golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash</p> https://cve.radiocsirt.org/vuln/rhsa-2021:0420 https://cve.radiocsirt.org/vuln/ubuntu-cve-2019-20477 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Ubuntu:20.04:LTS: pyyaml</p> <p>PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Ubuntu:20.04:LTS: pyyaml</p> <p>PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2019-20477