https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 07:09:25 +0000 https://cve.radiocsirt.org/vuln/bell-cve-2026-82049 <p><strong>Affected:</strong> Alpaquita:stream: python3, BellSoft Hardened Containers:stream: python3</p> <p><strong>Affected:</strong> Alpaquita:stream: python3, BellSoft Hardened Containers:stream: python3</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-82049 https://cve.radiocsirt.org/vuln/bit-libpython-2026-82049 <p><strong>Affected:</strong> Bitnami: libpython</p> <p>In CPython 3.13 and earlier, the tarfile module&#39;s data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.</p> <p><strong>Affected:</strong> Bitnami: libpython</p> <p>In CPython 3.13 and earlier, the tarfile module&#39;s data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.</p> https://cve.radiocsirt.org/vuln/bit-libpython-2026-82049 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1167 certfr-2026-avi-1167 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1167 https://cve.radiocsirt.org/vuln/euvd-2026-382003 EUVD-2026-382003 https://cve.radiocsirt.org/vuln/euvd-2026-382003 https://cve.radiocsirt.org/vuln/fkie_cve-2026-82049 <p>In CPython 3.13 and earlier, the tarfile module&#39;s data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.</p> <p>In CPython 3.13 and earlier, the tarfile module&#39;s data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-82049 https://cve.radiocsirt.org/vuln/ghsa-ghff-gcpf-9r9p <p>In CPython 3.13 and earlier, the tarfile module&#39;s data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.</p> <p>In CPython 3.13 and earlier, the tarfile module&#39;s data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.</p> https://cve.radiocsirt.org/vuln/ghsa-ghff-gcpf-9r9p https://cve.radiocsirt.org/vuln/msrc_cve-2026-82049 msrc_CVE-2026-82049 https://cve.radiocsirt.org/vuln/msrc_cve-2026-82049 https://cve.radiocsirt.org/vuln/oesa-2026-4009 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: python3</p> <p>Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces. Security Fix(es):</p> <p>The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication.(CVE-2026-15806)</p> <p>The &amp;qu…</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: python3</p> <p>Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces. Security Fix(es):</p> <p>The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication.(CVE-2026-15806)</p> <p>The &amp;qu…</p> https://cve.radiocsirt.org/vuln/oesa-2026-4009 https://cve.radiocsirt.org/vuln/rhsa-2026:65505 <p>python: Python: Information disclosure due to incorrect URL scheme matching python: Python stringprep module: Incorrect domain name processing breaks IDNA interoperability python: Python tarfile module: Directory traversal allows creation of empty directories outside extraction destination python: Python tarfile module: File modification and content disclosure via crafted archives</p> <p>python: Python: Information disclosure due to incorrect URL scheme matching python: Python stringprep module: Incorrect domain name processing breaks IDNA interoperability python: Python tarfile module: Directory traversal allows creation of empty directories outside extraction destination python: Python tarfile module: File modification and content disclosure via crafted archives</p> https://cve.radiocsirt.org/vuln/rhsa-2026:65505 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-82049 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: python2.7, Ubuntu:Pro:14.04:LTS: python3.4, Ubuntu:Pro:14.04:LTS: python3.5, Ubuntu:Pro:16.04:LTS: python2.7, Ubuntu:Pro:16.04:LTS: python3.5, Ubuntu:Pro:18.04:LTS: python2.7, Ubuntu:Pro:18.04:LTS: python3.6, Ubuntu:Pro:18.04:LTS: python3.7, Ubuntu:Pro:18.04:LTS: python3.8, Ubuntu:Pro:20.04:LTS: python3.8 and 11 more</p> <p>In CPython 3.13 and earlier, the tarfile module&#39;s data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: python2.7, Ubuntu:Pro:14.04:LTS: python3.4, Ubuntu:Pro:14.04:LTS: python3.5, Ubuntu:Pro:16.04:LTS: python2.7, Ubuntu:Pro:16.04:LTS: python3.5, Ubuntu:Pro:18.04:LTS: python2.7, Ubuntu:Pro:18.04:LTS: python3.6, Ubuntu:Pro:18.04:LTS: python3.7, Ubuntu:Pro:18.04:LTS: python3.8, Ubuntu:Pro:20.04:LTS: python3.8 and 11 more</p> <p>In CPython 3.13 and earlier, the tarfile module&#39;s data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-82049 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3367 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Python ausnutzen, um Daten zu manipulieren oder offenzulegen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Python ausnutzen, um Daten zu manipulieren oder offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3367