Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,934 results · page 29 of 39
Sep 9, 2022OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+.CVE-2022-36087 · Other software · oauthlib · reported by GitHubMedium 5.7
OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. In OAuthLib versions 3.1.1 until 3.2.1, an attacker providing malicious redirect uri can cause denial of service. An attacker can also leverage usage of `uri_validate` functions depending where it is used. OAuthLib applications using OAuth2.0 provider support or use directly `uri_validate` are affected by this issue. Version 3.2.1 contains a patch. There are no known workarounds.
- Product
- oauthlib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2022A flaw was found in python.CVE-2020-10735 · Other software · Siemens · reported by Red HatHigh 7.5
A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability.
- Product
- SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Sep 7, 2022Poetry is a dependency manager for Python.CVE-2022-36070 · Other software · python-poetry · reported by GitHubHigh 7.3
Poetry is a dependency manager for Python. To handle dependencies that come from a Git repository, Poetry executes various commands, e.g. `git config`. These commands are being executed using the executable’s name and not its absolute path. This can lead to the execution of untrusted code due to the way Windows resolves executable names to paths. Unlike Linux-based operating systems, Windows searches for the executable in the current directory first and looks in the paths that are defined in the `PATH` environment variable afterward. This vulnerability can lead to Arbitrary Code Execution, which would lead to the takeover of the system. If a developer is exploited, the attacker could steal credentials or persist their access. If the exploit happens on a server, the attackers could use their access to attack other internal systems. Since this vulnerability requires a fair amount of user interaction, it is not as dangerous as a remotely exploitable one. However, it still puts developers at risk when dealing with untrusted files in a way they think is safe. The victim could also not protect themself by vetting any Git or Poetry config files that might be present in the directory, beca
- Product
- poetry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2022Poetry is a dependency manager for Python.CVE-2022-36069 · Other software · python-poetry · reported by GitHubHigh 7.3
Poetry is a dependency manager for Python. When handling dependencies that come from a Git repository instead of a registry, Poetry uses various commands, such as `git clone`. These commands are constructed using user input (e.g. the repository URL). When building the commands, Poetry correctly avoids Command Injection vulnerabilities by passing an array of arguments instead of a command string. However, there is the possibility that a user input starts with a dash (`-`) and is therefore treated as an optional argument instead of a positional one. This can lead to Code Execution because some of the commands have options that can be leveraged to run arbitrary executables. If a developer is exploited, the attacker could steal credentials or persist their access. If the exploit happens on a server, the attackers could use their access to attack other internal systems. Since this vulnerability requires a fair amount of user interaction, it is not as dangerous as a remotely exploitable one. However, it still puts developers at risk when dealing with untrusted files in a way they think is safe, because the exploit still works when the victim tries to make sure nothing can happen, e.g. by
- Product
- poetry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2022A flaw was found in the python-scciclient when making an HTTPS connection to a server where the server's certificate would not be verified.CVE-2022-2996 · Other software · Python-scciclient Project · reported by Red HatHigh 7.4
A flaw was found in the python-scciclient when making an HTTPS connection to a server where the server's certificate would not be verified. This issue opens up the connection to possible Man-in-the-middle (MITM) attacks.
- Product
- Python-scciclient
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgopendev.org
Aug 29, 2022A flaw was found in python-oslo-utils.CVE-2022-0718 · Other software · Openstack · reported by Red HatMedium 4.9
A flaw was found in python-oslo-utils. Due to improper parsing, passwords with a double quote ( " ) in them cause incorrect masking in debug logs, causing any part of the password after the double quote to be plaintext.
- Product
- Oslo.utils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugs.launchpad.net
Aug 24, 2022A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode.CVE-2021-4189 · Other software · Siemens · reported by Red HatMedium 5.3
A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible.
- Product
- SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugs.python.org
Aug 22, 2022Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path whichCVE-2021-28861 · Other software · Siemens · reported by MITREHigh 7.4
Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states "Warning: http.server is not recommended for production. It only implements basic security checks."
- Product
- SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.python.orggithub.com
Aug 18, 2022Uncontrolled search path in the Intel(R) Distribution for Python before version 2022.0.3 may allow an authenticated user to potentially enable escalation of priCVE-2022-28696 · Other software · Intel · reported by secure@intel.comHigh 7.8
Uncontrolled search path in the Intel(R) Distribution for Python before version 2022.0.3 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Distribution For Python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2022py-cord is a an API wrapper for Discord written in Python.CVE-2022-36024 · Other software · Pycord-Development · reported by GitHubHigh 7.5
py-cord is a an API wrapper for Discord written in Python. Bots creating using py-cord version 2.0.0 are vulnerable to remote shutdown if they are added to the server with the `application.commands` scope without the `bot` scope. Currently, it appears that all public bots that use slash commands are affected. This issue has been patched in version 2.0.1. There are currently no recommended workarounds - please upgrade to a patched version.
- Product
- pycord
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2022Sanic is an opensource python web server/framework.CVE-2022-35920 · Other software · sanic-org · reported by GitHubHigh 8.3
Sanic is an opensource python web server/framework. Affected versions of sanic allow access to lateral directories when using `app.static` if using encoded `%2F` URLs. Parent directory traversal is not impacted. Users are advised to upgrade. There is no known workaround for this issue.
- Product
- sanic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2022Streamlit is a data oriented application development framework for python.CVE-2022-35918 · Other software · streamlit · reported by GitHubMedium 6.5
Streamlit is a data oriented application development framework for python. Users hosting Streamlit app(s) that use custom components are vulnerable to a directory traversal attack that could leak data from their web server file-system such as: server logs, world readable files, and potentially other sensitive information. An attacker can craft a malicious URL with file paths and the streamlit server would process that URL and return the contents of that file. This issue has been resolved in version 1.11.1. Users are advised to upgrade. There are no known workarounds for this issue.
- Product
- streamlit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2022Flask-AppBuilder is an application development framework built on top of Flask python framework.CVE-2022-31177 · Other software · dpgaspar · reported by GitHubLow 2.7
Flask-AppBuilder is an application development framework built on top of Flask python framework. In versions prior to 4.1.3 an authenticated Admin user could query other users by their salted and hashed passwords strings. These filters could be made by using partial hashed password strings. The response would not include the hashed passwords, but an attacker could infer partial password hashes and their respective users. This issue has been fixed in version 4.1.3. Users are advised to upgrade. There are no known workarounds for this issue.
- Product
- Flask-AppBuilder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2022untangle is a python library to convert XML data to python objects.CVE-2022-33977 · Other software · Christian Stefanescu · reported by vultures@jpcert.or.jpHigh 7.5
untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts recursive entity references in DTDs. By exploiting this vulnerability, a remote unauthenticated attacker may cause a denial-of-service (DoS) condition on the server where the product is running.
- Product
- untangle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2022untangle is a python library to convert XML data to python objects.CVE-2022-31471 · Other software · Christian Stefanescu · reported by vultures@jpcert.or.jpHigh 7.5
untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts XML external entity references. By exploiting this vulnerability, a remote unauthenticated attacker may read the contents of local files.
- Product
- untangle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2022pyenv 1.2.24 through 2.3.2 allows local users to gain privileges via a .python-version file in the current working directory.CVE-2022-35861 · Other software · Pyenv · reported by MITREHigh 7.8
pyenv 1.2.24 through 2.3.2 allows local users to gain privileges via a .python-version file in the current working directory. An attacker can craft a Python version string in .python-version to execute shims under their control. (Shims are executables that pass a command along to a specific version of pyenv. The version string is used to construct the path to the command, and there is no validation of whether the version specified is a valid version. Thus, relative path traversal can occur.)
- Product
- Pyenv
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2022This affects the package codecov before 2.0.16.CVE-2019-10800 · Other software · Codecov · reported by report@snyk.ioMedium 6.5
This affects the package codecov before 2.0.16. The vulnerability occurs due to not sanitizing gcov arguments before being being provided to the popen method.
- Product
- Codecov-python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The duducosmos/livro_python repository through 2018-06-06 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31575 · Other software · Livro Python Project · reported by MITRECritical 9.3
The duducosmos/livro_python repository through 2018-06-06 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Livro Python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The akashtalole/python-flask-restful-api repository through 2019-09-16 on GitHub allows absolute path traversal because the Flask send_file function is used unsCVE-2022-31571 · Other software · Python-flask-restful-api Project · reported by MITRECritical 9.3
The akashtalole/python-flask-restful-api repository through 2019-09-16 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Python-flask-restful-api
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The olmax99/pyathenastack repository through 2019-11-08 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31550 · Other software · Python Athena Stack Project · reported by MITRECritical 9.3
The olmax99/pyathenastack repository through 2019-11-08 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Python Athena Stack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The echoleegroup/PythonWeb repository through 2018-10-31 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31534 · Other software · Pythonweb Project · reported by MITRECritical 9.3
The echoleegroup/PythonWeb repository through 2018-10-31 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Pythonweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The JustAnotherSoftwareDeveloper/Python-Recipe-Database repository through 2021-03-31 on GitHub allows absolute path traversal because the Flask send_file functCVE-2022-31518 · Other software · Python-recipe-database Project · reported by MITRECritical 9.3
The JustAnotherSoftwareDeveloper/Python-Recipe-Database repository through 2021-03-31 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Python-recipe-database
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The Harveyzyh/Python repository through 2022-05-04 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31516 · Other software · Harveyzyh Python Project · reported by MITRECritical 9.3
The Harveyzyh/Python repository through 2022-05-04 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Harveyzyh Python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2022openssh_key_parser is an open source Python package providing utilities to parse and pack OpenSSH private and public key files.CVE-2022-31124 · Other software · scottcwang · reported by GitHubHigh 7.7
openssh_key_parser is an open source Python package providing utilities to parse and pack OpenSSH private and public key files. In versions prior to 0.0.6 if a field of a key is shorter than it is declared to be, the parser raises an error with a message containing the raw field value. An attacker able to modify the declared length of a key's sensitive field can thus expose the raw value of that field. Users are advised to upgrade to version 0.0.6, which no longer includes the raw field value in the error message. There are no known workarounds for this issue.
- Product
- openssh_key_parser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2022UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+.CVE-2022-31117 · Other software · ultrajson · reported by GitHubMedium 5.9
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. In versions prior to 5.4.0 an error occurring while reallocating a buffer for string decoding can cause the buffer to get freed twice. Due to how UltraJSON uses the internal decoder, this double free is impossible to trigger from Python. This issue has been resolved in version 5.4.0 and all users should upgrade to UltraJSON 5.4.0. There are no known workarounds for this issue.
- Product
- ultrajson
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2022UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+.CVE-2022-31116 · Other software · ultrajson · reported by GitHubHigh 7.5
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Affected versions were found to improperly decode certain characters. JSON strings that contain escaped surrogate characters not part of a proper surrogate pair were decoded incorrectly. Besides corrupting strings, this allowed for potential key confusion and value overwriting in dictionaries. All users parsing JSON from untrusted sources are vulnerable. From version 5.4.0, UltraJSON decodes lone surrogates in the same way as the standard library's `json` module does, preserving them in the parsed output. Users are advised to upgrade. There are no known workarounds for this issue.
- Product
- ultrajson
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2022The pyesasky for python, as distributed on PyPI, included a code-execution backdoor inserted by a third party.CVE-2022-30885 · Other software · ESA · reported by MITRECritical 9.8
The pyesasky for python, as distributed on PyPI, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 1.2.0-1.4.2.
- Product
- Pyesasky
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpypi.doubanio.comgithub.com
Jun 18, 2022python-ldap before 3.4.0 is vulnerable to a denial of service when ldap.schema is used for untrusted schema definitions, because of a regular expression denial CVE-2021-46823 · Other software · Python-ldap · reported by MITREMedium 6.5
python-ldap before 3.4.0 is vulnerable to a denial of service when ldap.schema is used for untrusted schema definitions, because of a regular expression denial of service (ReDoS) flaw in the LDAP schema parser. By sending crafted regex input, a remote authenticated attacker could exploit this vulnerability to cause a denial of service condition.
- Product
- Python-ldap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comgithub.com
Jun 16, 2022A vulnerability classified as problematic was found in Python 2.7.13.CVE-2017-20052 · Other software · unspecified · reported by VulDBMedium 5
A vulnerability classified as problematic was found in Python 2.7.13. This vulnerability affects unknown code of the component pgAdmin4. The manipulation leads to uncontrolled search path. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsecurity.netapp.com
Jun 15, 2022The httplib and urllib Python libraries that Splunk shipped with Splunk Enterprise did not validate certificates using the certificate authority (CA) certificatCVE-2022-32151 · Other software · Splunk, Inc · reported by prodsec@splunk.comHigh 7.4
The httplib and urllib Python libraries that Splunk shipped with Splunk Enterprise did not validate certificates using the certificate authority (CA) certificate stores by default in Splunk Enterprise versions before 9.0 and Splunk Cloud Platform versions before 8.2.2203. Python 3 client libraries now verify server certificates by default and use the appropriate CA certificate stores for each library. Apps and add-ons that include their own HTTP libraries are not affected. For Splunk Enterprise, update to Splunk Enterprise version 9.0 and Configure TLS host name validation for Splunk-to-Splunk communications (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation) to enable the remediation.
- Product
- Splunk Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.splunk.comdocs.splunk.com
Jun 9, 2022Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine.CVE-2022-29255 · Other software · vyperlang · reported by GitHubHigh 8.2
Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions prior to 0.3.4 when a calling an external contract with no return value, the contract address (including side effects) could be evaluated twice. This may result in incorrect outcomes for contracts. This issue has been addressed in v0.3.4.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2022The keep for python, as distributed on PyPI, included a code-execution backdoor inserted by a third party.CVE-2022-30877 · Other software · Keep Project · reported by MITRECritical 9.8
The keep for python, as distributed on PyPI, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 1.2.
- Product
- Keep
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpypi.doubanio.comgithub.com
Jun 2, 2022Flower, a web UI for the Celery Python RPC framework, all versions as of 05-02-2022 is vulnerable to an OAuth authentication bypass.CVE-2022-30034 · Other software · Flower Project · reported by MITREHigh 8.6
Flower, a web UI for the Celery Python RPC framework, all versions as of 05-02-2022 is vulnerable to an OAuth authentication bypass. An attacker could then access the Flower API to discover and invoke arbitrary Celery RPC calls or deny service by shutting down Celery task nodes.
- Product
- Flower
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtprynn.github.io
May 31, 2022Waitress is a Web Server Gateway Interface server for Python 2 and 3.CVE-2022-31015 · Other software · Pylons · reported by GitHubMedium 6.5
Waitress is a Web Server Gateway Interface server for Python 2 and 3. Waitress versions 2.1.0 and 2.1.1 may terminate early due to a thread closing a socket while the main thread is about to call select(). This will lead to the main thread raising an exception that is not handled and then causing the entire application to be killed. This issue has been fixed in Waitress 2.1.2 by no longer allowing the WSGI thread to close the socket. Instead, that is always delegated to the main thread. There is no work-around for this issue. However, users using waitress behind a reverse proxy server are less likely to have issues if the reverse proxy always reads the full response.
- Product
- waitress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2022libImaging/TgaRleDecode.c in Pillow 9.1.0 has a heap buffer overflow in the processing of invalid TGA image files.CVE-2022-30595 · Other software · Python · reported by MITRECritical 9.8
libImaging/TgaRleDecode.c in Pillow 9.1.0 has a heap buffer overflow in the processing of invalid TGA image files.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compillow.readthedocs.io
May 24, 2022PyJWT is a Python implementation of RFC 7519.CVE-2022-29217 · Other software · jpadilla · reported by GitHubHigh 7.4
PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choose the used signing algorithm. The PyJWT library requires that the application chooses what algorithms are supported. The application can specify `jwt.algorithms.get_default_algorithms()` to get support for all algorithms, or specify a single algorithm. The issue is not that big as `algorithms=jwt.algorithms.get_default_algorithms()` has to be used. Users should upgrade to v2.4.0 to receive a patch for this issue. As a workaround, always be explicit with the algorithms that are accepted and expected when decoding.
- Product
- pyjwt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2022pyscriptjs (aka PyScript Demonstrator) in PyScript through 2022-05-04 allows a remote user to read Python source code.CVE-2022-30286 · Other software · Pyscript · reported by MITREHigh 7.5
pyscriptjs (aka PyScript Demonstrator) in PyScript through 2022-05-04 allows a remote user to read Python source code.
- Product
- Pyscript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comcyber-guy.gitbook.io
May 8, 2022marcador package in PyPI 0.1 through 0.13 included a code-execution backdoor.CVE-2022-28470 · Other software · Python · reported by MITRECritical 9.8
marcador package in PyPI 0.1 through 0.13 included a code-execution backdoor.
- Product
- Pypi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpypi.doubanio.comgithub.com
May 4, 2022In the python-libnmap package through 0.7.2 for Python, remote command execution can occur (if used in a client application that does not validate arguments).CVE-2022-30284 · Other software · Python-libnmap Project · reported by MITRECritical 9
In the python-libnmap package through 0.7.2 for Python, remote command execution can occur (if used in a client application that does not validate arguments). NOTE: the vendor believes it would be unrealistic for an application to call NmapProcess with arguments taken from input data that arrived over an untrusted network, and thus the CVSS score corresponds to an unrealistic use case. None of the NmapProcess documentation implies that this is an expected use case
- Product
- Python-libnmap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlibnmap.readthedocs.io
Apr 18, 2022PyPDF2 is an open source python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files.CVE-2022-24859 · Other software · py-pdf · reported by GitHubMedium 6.2
PyPDF2 is an open source python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. In versions prior to 1.27.5 an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if the PyPDF2 if the code attempts to get the content stream. The reason is that the last while-loop in `ContentStream._readInlineImage` only terminates when it finds the `EI` token, but never actually checks if the stream has already ended. This issue has been resolved in version `1.27.5`. Users unable to upgrade should validate and PDFs prior to iterating over their content stream.
- Product
- PyPDF2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2022Vyper is a pythonic Smart Contract Language for the ethereum virtual machine.CVE-2022-24845 · Other software · vyperlang · reported by GitHubHigh 8.8
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In affected versions, the return of `<iface>.returns_int128()` is not validated to fall within the bounds of `int128`. This issue can result in a misinterpretation of the integer value and lead to incorrect behavior. As of v0.3.0, `<iface>.returns_int128()` is validated in simple expressions, but not complex expressions. Users are advised to upgrade. There is no known workaround for this issue.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2022Vyper is a pythonic Smart Contract Language for the ethereum virtual machine.CVE-2022-24788 · Other software · vyperlang · reported by GitHubHigh 7.1
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Versions of vyper prior to 0.3.2 suffer from a potential buffer overrun. Importing a function from a JSON interface which returns `bytes` generates bytecode which does not clamp bytes length, potentially resulting in a buffer overrun. Users are advised to upgrade. There are no known workarounds for this issue.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2022In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file.CVE-2015-20107 · Other software · Siemens · reported by MITREHigh 7.6
In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9
- Product
- SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.python.orggithub.com
Apr 4, 2022Twisted is an event-based framework for internet applications, supporting Python 3.6+.CVE-2022-24801 · Other software · twisted · reported by GitHubHigh 8.1
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to version 22.4.0rc1, the Twisted Web HTTP 1.1 server, located in the `twisted.web.http` module, parsed several HTTP request constructs more leniently than permitted by RFC 7230. This non-conformant parsing can lead to desync if requests pass through multiple HTTP parsers, potentially resulting in HTTP request smuggling. Users who may be affected use Twisted Web's HTTP 1.1 server and/or proxy and also pass requests through a different HTTP server and/or proxy. The Twisted Web client is not affected. The HTTP 2.0 server uses a different parser, so it is not affected. The issue has been addressed in Twisted 22.4.0rc1. Two workarounds are available: Ensure any vulnerabilities in upstream proxies have been addressed, such as by upgrading them; or filter malformed requests by other means, such as configuration of an upstream proxy.
- Product
- twisted
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2022Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine.CVE-2022-24787 · Other software · vyperlang · reported by GitHubHigh 7.5
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. In version 0.3.1 and prior, bytestrings can have dirty bytes in them, resulting in the word-for-word comparisons giving incorrect results. Even without dirty nonzero bytes, two bytestrings can compare to equal if one ends with `"\x00"` because there is no comparison of the length. A patch is available and expected to be part of the 0.3.2 release. There are currently no known workarounds.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2022A Python format string issue leading to information disclosure and potentially remote code execution in ConsoleMe for all versions prior to 1.2.2CVE-2022-27177 · Other software · Netflix · reported by security-report@netflix.comCritical 9.8
A Python format string issue leading to information disclosure and potentially remote code execution in ConsoleMe for all versions prior to 1.2.2
- Product
- Consoleme
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2022Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.CVE-2022-24303 · Other software · Python · reported by MITRECritical 9.1
Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Mar 21, 2022Poetry v1.1.9 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute Poetry cCVE-2022-26184 · Other software · Python-poetry · reported by MITRECritical 9.8
Poetry v1.1.9 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute Poetry commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS.
- Product
- Poetry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2022Waitress is a Web Server Gateway Interface server for Python 2 and 3.CVE-2022-24761 · Other software · Pylons · reported by GitHubHigh 7.5
Waitress is a Web Server Gateway Interface server for Python 2 and 3. When using Waitress versions 2.1.0 and prior behind a proxy that does not properly validate the incoming HTTP request matches the RFC7230 standard, Waitress and the frontend proxy may disagree on where one request starts and where it ends. This would allow requests to be smuggled via the front-end proxy to waitress and later behavior. There are two classes of vulnerability that may lead to request smuggling that are addressed by this advisory: The use of Python's `int()` to parse strings into integers, leading to `+10` to be parsed as `10`, or `0x01` to be parsed as `1`, where as the standard specifies that the string should contain only digits or hex digits; and Waitress does not support chunk extensions, however it was discarding them without validating that they did not contain illegal characters. This vulnerability has been patched in Waitress 2.1.1. A workaround is available. When deploying a proxy in front of waitress, turning on any and all functionality to make sure that the request matches the RFC7230 standard. Certain proxy servers may not have this functionality though and users are encouraged to upgra
- Product
- waitress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2022In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured.CVE-2022-26488 · Other software · Siemens · reported by MITREHigh 7
In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured. The installer may allow a local attacker to add user-writable directories to the system search path. To exploit, an administrator must have installed Python for all users and enabled PATH entries. A non-administrative user can trigger a repair that incorrectly adds user-writable paths into PATH, enabling search-path hijacking of other users and system services. This affects Python (CPython) through 3.7.12, 3.8.x through 3.8.12, 3.9.x through 3.9.10, and 3.10.x through 3.10.2.
- Product
- SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmail.python.orgsecurity.netapp.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.