https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 13:38:50 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-11380 bdu:2026-11380 https://cve.radiocsirt.org/vuln/bdu:2026-11380 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0317 certfr-2026-avi-0317 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0317 https://cve.radiocsirt.org/vuln/euvd-2026-281184 EUVD-2026-281184 https://cve.radiocsirt.org/vuln/euvd-2026-281184 https://cve.radiocsirt.org/vuln/fkie_cve-2026-3479 <p>DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation has been updated to clarify this point. There is no vulnerability in the function if following the intended security model.</p> <p>pkgutil.get_data() did not validate the resource argument as documented, allowing path traversals.</p> <p>DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation has been updated to clarify this point. There is no vulnerability in the function if following the intended security model.</p> <p>pkgutil.get_data() did not validate the resource argument as documented, allowing path traversals.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-3479 https://cve.radiocsirt.org/vuln/ghsa-43rw-359f-4h89 <p>pkgutil.get_data() did not validate the resource argument as documented, allowing path traversals.</p> <p>pkgutil.get_data() did not validate the resource argument as documented, allowing path traversals.</p> https://cve.radiocsirt.org/vuln/ghsa-43rw-359f-4h89 https://cve.radiocsirt.org/vuln/msrc_cve-2026-3479 msrc_CVE-2026-3479 https://cve.radiocsirt.org/vuln/msrc_cve-2026-3479 https://cve.radiocsirt.org/vuln/oesa-2026-1899 <p><strong>Affected:</strong> openEuler:24.03-LTS: python3</p> <p>Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces. Security Fix(es):</p> <p>The &amp;quot;tarfile&amp;quot; module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.(CVE-2025-13462)</p> <p>DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation has been updated to clarify this point. There is no vulnerability in the function if following the intended security model.</p> <p>pkgutil.get_data() did not validate the resource argument as documented, allowing path traversals.(CVE-2026-3479)</p> <p>The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additiona…</p> <p><strong>Affected:</strong> openEuler:24.03-LTS: python3</p> <p>Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces. Security Fix(es):</p> <p>The &amp;quot;tarfile&amp;quot; module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.(CVE-2025-13462)</p> <p>DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation has been updated to clarify this point. There is no vulnerability in the function if following the intended security model.</p> <p>pkgutil.get_data() did not validate the resource argument as documented, allowing path traversals.(CVE-2026-3479)</p> <p>The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additiona…</p> https://cve.radiocsirt.org/vuln/oesa-2026-1899 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10520-1 <p>python310-3.10.20-4.1 on GA media</p> <p>python310-3.10.20-4.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10520-1 https://cve.radiocsirt.org/vuln/rhsa-2026:10118 <p>cpython: cpython: `tarfile` module misinterprets crafted tar archives leading to data integrity issues python: Python base64: Incomplete data decoding due to premature stop at padding python: Python pkgutil.get_data(): Path Traversal via improper resource argument validation</p> <p>cpython: cpython: `tarfile` module misinterprets crafted tar archives leading to data integrity issues python: Python base64: Incomplete data decoding due to premature stop at padding python: Python pkgutil.get_data(): Path Traversal via improper resource argument validation</p> https://cve.radiocsirt.org/vuln/rhsa-2026:10118 https://cve.radiocsirt.org/vuln/suse-su-2026:1292-1 <p>Security update for python312</p> <p>Security update for python312</p> https://cve.radiocsirt.org/vuln/suse-su-2026:1292-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-3479 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: python2.7, Ubuntu:Pro:14.04:LTS: python3.4, Ubuntu:Pro:14.04:LTS: python3.5, Ubuntu:Pro:16.04:LTS: python2.7, Ubuntu:Pro:16.04:LTS: python3.5, Ubuntu:Pro:18.04:LTS: python2.7, Ubuntu:Pro:18.04:LTS: python3.6, Ubuntu:Pro:18.04:LTS: python3.7, Ubuntu:Pro:18.04:LTS: python3.8, Ubuntu:Pro:20.04:LTS: python3.8 and 14 more</p> <p>DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation has been updated to clarify this point. There is no vulnerability in the function if following the intended security model. pkgutil.get_data() did not validate the resource argument as documented, allowing path traversals.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: python2.7, Ubuntu:Pro:14.04:LTS: python3.4, Ubuntu:Pro:14.04:LTS: python3.5, Ubuntu:Pro:16.04:LTS: python2.7, Ubuntu:Pro:16.04:LTS: python3.5, Ubuntu:Pro:18.04:LTS: python2.7, Ubuntu:Pro:18.04:LTS: python3.6, Ubuntu:Pro:18.04:LTS: python3.7, Ubuntu:Pro:18.04:LTS: python3.8, Ubuntu:Pro:20.04:LTS: python3.8 and 14 more</p> <p>DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation has been updated to clarify this point. There is no vulnerability in the function if following the intended security model. pkgutil.get_data() did not validate the resource argument as documented, allowing path traversals.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-3479 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0791 <p>Ein lokaler Angreifer kann eine Schwachstelle in Python ausnutzen, um einen Path-Traversal Angriff durchzuführen.</p> <p>Ein lokaler Angreifer kann eine Schwachstelle in Python ausnutzen, um einen Path-Traversal Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0791