Python Cpython

Regular-expression DoS when parsing TarFile headers

also in 7 other products

Python Software Foundation CPython: Uncontrolled Resource Consumption

also in 17 other products

The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection

also in 2 other products

tarfile.data_filter path traversal bypass allows writing outside the extraction directory

also in 1 other product

tarfile extraction filter bypass allows escaping the destination directory

also in 2 other products

bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow

also in 2 other products

tarfile extraction filters allow file modification and content disclosure via hard link to symlink

also in 1 other product

FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address

also in 3 other products

HTMLParser quadratic complexity when processing malformed inputs

also in 6 other products

Python Software Foundation CPython: Race Condition

also in 1 other product

HTTP client proxy tunnel headers not validated for CR/LF

also in 4 other products

ZIP64 End of Central Directory (EOCD) Locator record offset not checked

also in 6 other products

SourcelessFileLoader does not use io.open_code()

also in 7 other products

Quadratic complexity in os.path.expandvars() with user-controlled template

also in 6 other products

Configuration Injection via Carriage Return (\r) in write() method

also in 2 other products

Python Software Foundation CPython: Stack-based Buffer Overflow

also in 1 other product

tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling

also in 3 other products

Base64 decoding stops at first padded quad by default

also in 2 other products

pkgutil.get_data() does not enforce documented restrictions

also in 2 other products