bugs.txt

1179:
    author: Ismail Donmez
    date: 2007-09-19.01:02:34.135
    title: '[CVE-2007-4965] Integer overflow in imageop module'
2254:
    author: sumar
    date: 2008-03-07.19:59:43.063
    title: Python CGIHTTPServer information disclosure
2620:
    author: Justin Ferguson
    date: 2008-04-11.22:35:34.407
    title: Multiple buffer overflows in unicode processing
6706:
    author: Giampaolo Rodola'
    date: 2009-08-14.23:03:34.855
    title: asyncore's accept() is broken
6791:
    author: sumar
    date: 2009-08-28.08:32:32.461
    title: httplib read status memory usage
7673:
    author: STINNER Victor
    date: 2010-01-11.01:05:03.678
    title: 'audioop: check that length is a multiple of the size'
8674:
    author: Tomas Hoger
    date: 2010-05-10.13:43:22.651
    title: 'audioop: incorrect integer overflow checks'
11442:
    author: Guido van Rossum
    date: 2011-03-08.19:05:14.954
    title: list_directory() in SimpleHTTPServer.py should add charset=... to Content-type
        header
11662:
    author: Guido van Rossum
    date: 2011-03-24.15:06:56.972
    title: Redirect vulnerability in urllib/urllib2
13512:
    author: Vincent Danen
    date: 2011-11-30.23:23:22.338
    title: ~/.pypirc created insecurely
13703:
    author: Barry A. Warsaw
    date: 2012-01-03.19:36:49.543
    title: Hash collision security issue
13885:
    author: Antoine Pitrou
    date: 2012-01-27.08:25:52.527
    title: 'CVE-2011-3389: _ssl module always disables the CBC IV attack countermeasure'
14001:
    author: Jan Lieskovsky
    date: 2012-02-13.13:45:32.834
    title: 'CVE-2012-0845 Python v2.7.2 / v3.2.2 (SimpleXMLRPCServer): DoS (excessive
        CPU usage) by processing malformed XMLRPC / HTTP POST request'
14579:
    author: Serhiy Storchaka
    date: 2012-04-14.18:46:02.834
    title: 'CVE-2012-2135: Vulnerability in the utf-16 decoder after error handling'
14621:
    author: Vlado Boza
    date: 2012-04-19.17:58:08.874
    title: Hash function is not randomized properly
16038:
    author: Christian Heimes
    date: 2012-09-25.10:32:54.388
    title: 'ftplib: unlimited readline() from connection'
16039:
    author: Christian Heimes
    date: 2012-09-25.10:36:09.924
    title: 'imaplib: unlimited readline() from connection'
16040:
    author: Christian Heimes
    date: 2012-09-25.10:38:44.757
    title: 'nntplib: unlimited readline() from connection'
16041:
    author: Christian Heimes
    date: 2012-09-25.10:39:22.625
    title: 'poplib: unlimited readline() from connection'
16042:
    author: Christian Heimes
    date: 2012-09-25.10:40:09.309
    title: 'smtplib: unlimited readline() from connection'
16043:
    author: Christian Heimes
    date: 2012-09-25.10:52:06.242
    title: 'xmlrpc: gzip_decode has unlimited read()'
17980:
    author: Florian Weimer
    date: 2013-05-15.10:25:06.260
    title: "CVE-2013-2099 ssl.match_hostname() trips over crafted\twildcard names"
17997:
    author: Christian Heimes
    date: 2013-05-17.14:04:53.621
    title: 'ssl.match_hostname(): sub string wildcard should not match IDNA prefix'
18709:
    author: Christian Heimes
    date: 2013-08-12.11:32:51.937
    title: SSL module fails to handle NULL bytes inside subjectAltNames general names
        (CVE-2013-4238)
19435:
    author: Alexander Kruppa
    date: 2013-10-29.16:34:01.203
    title: Directory traversal attack for CGIHTTPRequestHandler
20078:
    author: Nandiya
    date: 2013-12-27.02:11:15.324
    title: zipfile - ZipExtFile.read goes into 100% CPU infinite loop on maliciously
        binary edited zips
20246:
    author: Ryan Smith-Roberts
    date: 2014-01-14.00:43:59.073
    title: buffer overflow in socket.recvfrom_into
21082:
    author: Ryan Lortie
    date: 2014-03-28.07:04:05.588
    title: 'os.makedirs(exist_ok=True) is not thread-safe: umask is set temporary
        to 0, serious security problem'
21529:
    author: Benjamin Peterson
    date: 2014-05-19.00:40:48.909
    title: 'JSON module: reading arbitrary process memory'
21831:
    author: Benjamin Peterson
    date: 2014-06-24.03:11:22.499
    title: integer overflow in 'buffer' type allows reading memory
22417:
    author: Nick Coghlan
    date: 2014-09-15.12:34:29.145
    title: 'PEP 476: verify HTTPS certificates by default'
22928:
    author: Guido Vranken
    date: 2014-11-24.02:50:23.165
    title: HTTP header injection in urrlib2/urllib/httplib/http.client (CVE-2016-5699)
26171:
    author: Insu Yun
    date: 2016-01-21.03:52:31.863
    title: heap overflow in zipimporter module
26556:
    author: Christian Heimes
    date: 2016-03-14.10:31:35.077
    title: Update expat to 2.1.1
26657:
    author: Thomas
    date: 2016-03-28.15:30:14.841
    title: Directory traversal with http.server and SimpleHTTPServer on windows
27568:
    author: "R\xE9mi Rampin"
    date: 2016-07-18.22:30:13.649
    title: '"HTTPoxy", use of HTTP_PROXY flag supplied by attacker in CGI scripts'
27850:
    author: Christian Heimes
    date: 2016-08-24.13:43:47.563
    title: Remove 3DES from cipher list (sweet32 CVE-2016-2183)
28563:
    author: Carl Ekerot
    date: 2016-10-30.16:58:40.897
    title: Arbitrary code execution in gettext.c2py
29169:
    author: Matthias Klose
    date: 2017-01-05.15:11:35.326
    title: update zlib to 1.2.11
29591:
    author: Natanael Copa
    date: 2017-02-17.15:39:39.187
    title: 'expat 2.2.0: Various security vulnerabilities in bundled expat (CVE-2016-0718
        and CVE-2016-4472)'
30119:
    author: Dong-hee Na
    date: 2017-04-20.17:57:20.197
    title: (ftplib) A remote attacker could possibly attack by containing the newline
        characters
30458:
    author: Orange
    date: 2017-05-24.15:01:31.674
    title: '[security][CVE-2019-9740][CVE-2019-9947] HTTP Header Injection (follow-up
        of CVE-2016-5699)'
30500:
    author: Nam Nguyen
    date: 2017-05-29.04:04:11.735
    title: '[security] urllib connects to a wrong host'
30657:
    author: Jay Bosamiya
    date: 2017-06-13.15:35:28.798
    title: '[security] CVE-2017-1000158: Unsafe arithmetic in PyString_DecodeEscape'
30694:
    author: Ned Deily
    date: 2017-06-18.03:01:26.301
    title: Update embedded copy of expat to 2.2.1
30730:
    author: Serhiy Storchaka
    date: 2017-06-22.08:06:59.735
    title: '[security] Injecting environment variable in subprocess on Windows'
30947:
    author: STINNER Victor
    date: 2017-07-17.14:18:15.565
    title: Update embeded copy of libexpat from 2.2.1 to 2.2.3
31530:
    author: STINNER Victor
    date: 2017-09-20.13:27:12.407
    title: 'CVE-2018-1000030: Python 2.7 readahead feature of file objects is not
        thread safe'
32981:
    author: James Davis
    date: 2018-03-02.00:36:19.614
    title: Catastrophic backtracking in poplib (CVE-2018-1060) and difflib (CVE-2018-1061)
33001:
    author: Steve Dower
    date: 2018-03-05.18:04:42.468
    title: Buffer overflow vulnerability in os.symlink on Windows (CVE-2018-1000117)
33529:
    author: Rad164
    date: 2018-05-16.00:12:26.510
    title: '[security] Infinite loop on folding email (_fold_as_ew()) if an header
        has no spaces'
34623:
    author: Christian Heimes
    date: 2018-09-10.22:47:44.343
    title: _elementtree.c doesn't call XML_SetHashSalt()
34656:
    author: shuoz
    date: 2018-09-13.04:38:46.491
    title: '[CVE-2018-20406] memory exhaustion in Modules/_pickle.c:1393'
34791:
    author: Christian Heimes
    date: 2018-09-24.16:47:30.436
    title: xml package does not obey sys.flags.ignore_environment
35746:
    author: Cisco Talos
    date: 2019-01-15.16:24:28.272
    title: '[ssl][CVE-2019-5010] TALOS-2018-0758 Denial of Service'
35907:
    author: Sihoon Lee
    date: 2019-02-06.08:19:50.837
    title: '[security][CVE-2019-9948] Unnecessary URL scheme exists to allow file://
        reading file  in urllib'
36216:
    author: Steve Dower
    date: 2019-03-06.17:37:20.064
    title: urlsplit does not handle NFKC normalization
36260:
    author: JUN-WEI SONG
    date: 2019-03-11.07:16:58.562
    title: '[security] CVE-2019-9674: Zip Bomb vulnerability'