https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 07:01:42 +0000 https://cve.radiocsirt.org/vuln/alsa-2025:3631 <p><strong>Affected:</strong> AlmaLinux:9: python3.12, AlmaLinux:9: python3.12-debug, AlmaLinux:9: python3.12-devel, AlmaLinux:9: python3.12-idle, AlmaLinux:9: python3.12-libs, AlmaLinux:9: python3.12-test, AlmaLinux:9: python3.12-tkinter</p> <p>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.</p> <p>Security Fix(es):</p> <p>* cpython: python: Uncontrolled CPU resource consumption when in http.cookies module (CVE-2024-7592)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:9: python3.12, AlmaLinux:9: python3.12-debug, AlmaLinux:9: python3.12-devel, AlmaLinux:9: python3.12-idle, AlmaLinux:9: python3.12-libs, AlmaLinux:9: python3.12-test, AlmaLinux:9: python3.12-tkinter</p> <p>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.</p> <p>Security Fix(es):</p> <p>* cpython: python: Uncontrolled CPU resource consumption when in http.cookies module (CVE-2024-7592)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2025:3631 https://cve.radiocsirt.org/vuln/bdu:2024-08618 bdu:2024-08618 https://cve.radiocsirt.org/vuln/bdu:2024-08618 https://cve.radiocsirt.org/vuln/bell-cve-2024-7592 <p><strong>Affected:</strong> Alpaquita:23: python3, Alpaquita:stream: py3-tornado, Alpaquita:stream: python3, BellSoft Hardened Containers:23: python3, BellSoft Hardened Containers:stream: python3</p> <p><strong>Affected:</strong> Alpaquita:23: python3, Alpaquita:stream: py3-tornado, Alpaquita:stream: python3, BellSoft Hardened Containers:23: python3, BellSoft Hardened Containers:stream: python3</p> https://cve.radiocsirt.org/vuln/bell-cve-2024-7592 https://cve.radiocsirt.org/vuln/bit-libpython-2024-7592 <p><strong>Affected:</strong> Bitnami: libpython</p> <p>There is a LOW severity vulnerability affecting CPython, specifically the &#39;http.cookies&#39; standard library module.</p> <p>When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used while parsing the value.</p> <p><strong>Affected:</strong> Bitnami: libpython</p> <p>There is a LOW severity vulnerability affecting CPython, specifically the &#39;http.cookies&#39; standard library module.</p> <p>When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used while parsing the value.</p> https://cve.radiocsirt.org/vuln/bit-libpython-2024-7592 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0958 certfr-2024-avi-0958 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0958 https://cve.radiocsirt.org/vuln/cleanstart-2026-ay28538 <p><strong>Affected:</strong> CleanStart: cassandra, CleanStart: cassandra-fips, CleanStart: kserve-storage-controller, CleanStart: python3</p> <p>CVE-2024-7592 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Affected:</strong> CleanStart: cassandra, CleanStart: cassandra-fips, CleanStart: kserve-storage-controller, CleanStart: python3</p> <p>CVE-2024-7592 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-ay28538 https://cve.radiocsirt.org/vuln/euvd-2026-258724 EUVD-2026-258724 https://cve.radiocsirt.org/vuln/euvd-2026-258724 https://cve.radiocsirt.org/vuln/fkie_cve-2024-7592 <p>There is a LOW severity vulnerability affecting CPython, specifically the &#39;http.cookies&#39; standard library module.</p> <p>When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used while parsing the value.</p> <p>There is a LOW severity vulnerability affecting CPython, specifically the &#39;http.cookies&#39; standard library module.</p> <p>When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used while parsing the value.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-7592 https://cve.radiocsirt.org/vuln/ghsa-7pwv-g7hj-39pr <p>There is a LOW severity vulnerability affecting CPython, specifically the &#39;http.cookies&#39; standard library module.</p> <p>When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used while parsing the value.</p> <p>There is a LOW severity vulnerability affecting CPython, specifically the &#39;http.cookies&#39; standard library module.</p> <p>When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used while parsing the value.</p> https://cve.radiocsirt.org/vuln/ghsa-7pwv-g7hj-39pr https://cve.radiocsirt.org/vuln/msrc_cve-2024-7592 msrc_CVE-2024-7592 https://cve.radiocsirt.org/vuln/msrc_cve-2024-7592 https://cve.radiocsirt.org/vuln/oesa-2024-2116 <p><strong>Affected:</strong> openEuler:22.03-LTS-SP3: python3</p> <p>Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces. Security Fix(es): There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized.(CVE-2024-6923) There is a LOW severity vulnerability affecting CPython, specifically the &amp;apos;http.cookies&amp;apos; standard library module.</p> <p>When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used while parsing the value.(CVE-2024-7592) There is a HIGH severity vulnerability affecting the CPython &amp;quot;zipfile&amp;quot; module affecting &amp;quot;zipfile.Path&amp;quot;. Note that the more common API &amp;quot;zipfile.ZipFile&amp;quot; class is unaffected. When iterating over names of entries in a zip archive (for example, methods of &amp;quot;zipfile.Path&amp;quot; like &amp;quot;namelist()&amp;quot;, &amp;quot;…</p> <p><strong>Affected:</strong> openEuler:22.03-LTS-SP3: python3</p> <p>Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces. Security Fix(es): There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized.(CVE-2024-6923) There is a LOW severity vulnerability affecting CPython, specifically the &amp;apos;http.cookies&amp;apos; standard library module.</p> <p>When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used while parsing the value.(CVE-2024-7592) There is a HIGH severity vulnerability affecting the CPython &amp;quot;zipfile&amp;quot; module affecting &amp;quot;zipfile.Path&amp;quot;. Note that the more common API &amp;quot;zipfile.ZipFile&amp;quot; class is unaffected. When iterating over names of entries in a zip archive (for example, methods of &amp;quot;zipfile.Path&amp;quot; like &amp;quot;namelist()&amp;quot;, &amp;quot;…</p> https://cve.radiocsirt.org/vuln/oesa-2024-2116 https://cve.radiocsirt.org/vuln/opensuse-su-2024:14345-1 <p>python310-3.10.15-1.1 on GA media</p> <p>python310-3.10.15-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:14345-1 https://cve.radiocsirt.org/vuln/ssa-202008 <p>An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths if the administrator has used &#34;group blacklisting&#34; (e.g., chmod g-rwx) to restrict access to paths. This flaw effectively reverts a security feature in the kernel (in particular, the /proc/self/setgroups knob) to prevent this sort of privilege escalation. GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications that occurred only with access to a signing subkey. remember_Ktype in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumption (aka OOM). This can occur during execution of cxxfilt. binutils version 2.32 and earlier contains a Integer Overflow vulnerability in objdump, bfd_get_dynamic_reloc_upper_bound,bfd_canonicalize_dynamic_reloc that can result in Integer overflow trigger heap overflow. Successful exploitation allows execution of arbitrary code.. This attack appear to be exploitable via Local. This vulnerability appears to have been fixed in after commit 3a551c7a1b80fca579461774860574eabfd7f18f. libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the ar…</p> <p>An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths if the administrator has used &#34;group blacklisting&#34; (e.g., chmod g-rwx) to restrict access to paths. This flaw effectively reverts a security feature in the kernel (in particular, the /proc/self/setgroups knob) to prevent this sort of privilege escalation. GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications that occurred only with access to a signing subkey. remember_Ktype in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumption (aka OOM). This can occur during execution of cxxfilt. binutils version 2.32 and earlier contains a Integer Overflow vulnerability in objdump, bfd_get_dynamic_reloc_upper_bound,bfd_canonicalize_dynamic_reloc that can result in Integer overflow trigger heap overflow. Successful exploitation allows execution of arbitrary code.. This attack appear to be exploitable via Local. This vulnerability appears to have been fixed in after commit 3a551c7a1b80fca579461774860574eabfd7f18f. libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the ar…</p> https://cve.radiocsirt.org/vuln/ssa-202008 https://cve.radiocsirt.org/vuln/suse-el-9-client-tools-2024-4029 <p>Security update for SUSE Manager Salt Bundle</p> <p>Security update for SUSE Manager Salt Bundle</p> https://cve.radiocsirt.org/vuln/suse-el-9-client-tools-2024-4029 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-7592 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: python2.7, Ubuntu:Pro:14.04:LTS: python3.5, Ubuntu:Pro:14.04:LTS: python3.4, Ubuntu:Pro:16.04:LTS: python2.7, Ubuntu:Pro:16.04:LTS: python3.5, Ubuntu:Pro:18.04:LTS: python2.7, Ubuntu:Pro:18.04:LTS: python3.6, Ubuntu:Pro:18.04:LTS: python3.7, Ubuntu:Pro:18.04:LTS: python3.8, Ubuntu:20.04:LTS: python3.8 and 6 more</p> <p>There is a LOW severity vulnerability affecting CPython, specifically the &#39;http.cookies&#39; standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used while parsing the value.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: python2.7, Ubuntu:Pro:14.04:LTS: python3.5, Ubuntu:Pro:14.04:LTS: python3.4, Ubuntu:Pro:16.04:LTS: python2.7, Ubuntu:Pro:16.04:LTS: python3.5, Ubuntu:Pro:18.04:LTS: python2.7, Ubuntu:Pro:18.04:LTS: python3.6, Ubuntu:Pro:18.04:LTS: python3.7, Ubuntu:Pro:18.04:LTS: python3.8, Ubuntu:20.04:LTS: python3.8 and 6 more</p> <p>There is a LOW severity vulnerability affecting CPython, specifically the &#39;http.cookies&#39; standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used while parsing the value.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-7592 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1889 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Python ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Python ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1889