forked from vstinner/python-security
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathvulnerabilities.yaml
1255 lines (1117 loc) · 45.6 KB
/
vulnerabilities.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
# Vulnerabilities: http://www.itsecdb.com/oval/definitions/product-18230/0/Python-Python.html?class=5
# Template:
# - name: ""
# # Optional: generated from the name if omitted
# slug:
# # CVE can be a single string or a list
# cve:
# # Bug number at bugs.python.org (bpo)
# bpo:
# links:
# -
# disclosure: "" -- optional, use bpo if missing
# reported-at: ""
# reported-by: ""
# fixed-in:
# - branch: commit_sha1
# - branch: commit_sha1
# affected-versions:
# - "x.y"
# description: |
#
# Other tag: "ignore-python3: true", used for modules removed from Python 3
- name: "urllib FTP protocol stream injection"
slug: urllib-ftp-stream-injection
cve:
# Bug number at bugs.python.org (bpo)
bpo: 30119
links:
- http://blog.blindspotsecurity.com/2017/02/advisory-javapython-ftp-injections.html
- http://www.openwall.com/lists/oss-security/2017/02/20/1
- https://bugzilla.redhat.com/show_bug.cgi?id=1478916
disclosure: "2017-02-20 (blog post, mail to oss-security)"
reported-at: "2016-01-15 (email sent to the PSRT list)"
reported-by: "Timothy D. Morgan (Blindspot)"
fixed-in:
- 2.7: e5eae474c431af2880a68f6329840b9288fc4bc1
- 3.3: a4e774f86224cd8c997deaa4e71312cf1a7b023c
- 3.4: 2a5a26c87e82c7d9a348792891feccd1b5e9a769
- 3.5: 19b2890014d3098147d16475c492a47a43893768
- 3.6: 8c2d4cf092c5f0335e7982392a33927579c4d512
- 3.7: 2b1e6e9696cb433c0e0da11145157d54275d119f
description: |
FTP protocol stream injection via malicious URLs.
- name: "bpo-30500: urllib connects to a wrong host"
slug: urllib-connects-wrong-host
bpo: 30500
reported-at: 2017-03-04 (Orange Tsai on the PSRT list)
description: |
The urllib module doesn't parse correctly password containing the ``#``
character.
fixed-in:
- 3.7: 90e01e50ef8a9e6c91f30d965563c378a4ad26de
- 3.6: b0fba8874a4bd6bf4773e6efdbd8fa762e9f05bd
- 3.5: 4899d847ed3f56b2a712799f896aa1f28540a5c0
- 3.4: cc54c1c0d2d05fe7404ba64c53df4b1352ed2262
- 3.3: 052f9d6860c48c5abcff8e16212e77cf4249d66c
- 2.7: d4324baca4c03eb8d55446cd1b74b32ec5633af5
- name: "smtplib TLS stripping"
slug: smtplib-tls-stripping
cve: CVE-2016-0772
disclosure: 2016-06-11 (commit date)
reported-at: 2016-02-01 (Red Hat issue reported)
reported-by: Tin (Team Oststrom)
links:
- http://seclists.org/oss-sec/2016/q2/541
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-0772
description: |
A vulnerability in smtplib allowing MITM attacker to perform a startTLS
stripping attack. smtplib does not seem to raise an exception when the
remote end (SMTP server) is capable of negotiating starttls but fails to
respond with 220 (ok) to an explicit call of SMTP.starttls(). This may
allow a malicious MITM to perform a startTLS stripping attack if the client
code does not explicitly check the response code for startTLS.
fixed-in:
- 2.7: 2e1b7fc998e1744eeb3bb31b131eba0145b88a2f
- 3.3: 3625f7fd11679ecb390ffa58ef36d487acc8159b
- 3.4: 46b32f307c48bcb999b22eebf65ffe8ed5cca544
- name: "Issue #26657: HTTP server directory traversal"
slug: http-server-directory-traversal
bpo: 26657
fixed-in:
- 2.7: 0cf2cf2b7d726d12a6046441e4067d32c7dd4feb
- 3.4: 6f6bc1da8aaae52664e7747e328d26eb59c0e74f
- 3.5: d274b3f1f1e2d8811733fb952c9f18d7da3a376a
- 3.3: 7b92f9fa47df754b50c64aac84cf1c09693571af
description: |
Fix directory traversal vulnerability with ``http.server`` and
``SimpleHTTPServer`` on Windows.
Regression of Python 3.3.5.
Python issue reported at 2016-03-14.
- name: "Issue #26556: Expat 2.1.1"
slug: expat-2.1.1
cve: CVE-2015-1283
bpo: 26556
links:
- https://sourceforge.net/p/expat/bugs/528/
reported-at: "2015-07-24 (Expat issue #528 reported)"
reported-by: David Dillard (Expat issue)
fixed-in:
- 2.7: d244a8f7cb0ec6979ec9fc7acd39e95f5339ad0e
- 3.4: 196d7db3956f4c0b03e87b570771b3460a61bab5
- 3.3: ab90986600ba7dea2aa41e5c1773791070725453
description: |
Multiple integer overflows have been discovered in Expat, an XML parsing C
library, which may result in denial of service or the execution of
arbitrary code if a malformed XML file is processed.
Update bundled copy of Expat library to version 2.1.1 to get CVE-2015-1283
fixes.
- name: "HTTP header injection"
slug: http-header-injection
cve: CVE-2016-5699
bpo: 22928
links:
- http://blog.blindspotsecurity.com/2016/06/advisory-http-header-injection-in.html
redhat-impact: "Moderate"
fixed-in:
- 2.7: 59bdf6392de446de8a19bfa37cee52981612830e
- 3.4: a112a8ae47813f75aa8ad27ee8c42a7c2e937d13
- 3.5: b669bfc2bed1f5487ac2762bff53b55f6155bb60
- 3.3: 8e88f6b5e2a35ee458c161aa3f2b7f1f17fb45d1
description: |
HTTP header injection in ``urllib``, ``urrlib2``, ``httplib`` and
``http.client`` modules.
CRLF injection vulnerability in the ``HTTPConnection.putheader()`` function
in ``urllib2`` and ``urllib`` in CPython before 2.7.10 and 3.x before 3.4.4
allows remote attackers to inject arbitrary HTTP headers via CRLF sequences
in a URL.
Reported again in January 2016 by Timothy D. Morgan (Blindspot Security),
with a full disclosed at 2016-06-15.
- name: "Hash DoS"
slug: hash-dos
cve: CVE-2012-1150
disclosure: 2011-12-28 (CCC talk)
reported-by: Alexander “alech” Klink and Julian “zeri” Wälde
bpo: 13703
links:
- https://events.ccc.de/congress/2011/Fahrplan/events/4680.en.html
- http://www.ocert.org/advisories/ocert-2011-003.html
fixed-in:
- 2.6: 1e13eb084f72d5993cbb726e45b36bdb69c83a24
- 2.7: 2daf6ae2495c862adf8bc717bfe9964081ea0b10
description: |
Hash collision denial of service.
Python 2.7 and older and Python 3.2 and older require the ``-R`` command
line option to enable the enable hash function randomization. Randomization
is enabled by default since Python 3.3 (the ``-R`` option is ignored).
"Effective Denial of Service attacks against web application platforms"
talk at the CCC: 2011-12-28
See also the `PEP 456: Secure and interchangeable hash algorithm
<https://www.python.org/dev/peps/pep-0456/>`_: Python 3.4 switched to
`SipHash <https://131002.net/siphash/>`_.
* Ruby: CRuby 1.9 fixed the vulnerability in 2008 with randomized hash
function; JRuby has also been fixed.
* Perl: Perl 5.8.1 fixed the vulnerability in 2003 using a random
"PERL_HASH_SEED".
- name: "zipimporter overflow"
slug: zipimporter-overflow
cve: CVE-2016-5636
bpo: 26171
fixed-in:
- 2.7: 64ea192b73e39e877d8b39ce6584fa580eb0e9b4
- 3.3: d751040b1a4e35fd3b01fc919cd8f9374ed714fd
- 3.4: c4032da2012d75c6c358f74d8bf9ee98a7fe8ecf
description: |
Heap overflow in ``zipimporter`` module.
- name: "smtplib unlimited read"
slug: smtplib-unlimited-read
cve: CVE-2013-1752
bpo: 16042
links:
- https://access.redhat.com/security/cve/cve-2013-1752
redhat-impact: "Moderate"
fixed-in:
- 2.7: dabfc56b57f5086eb5522d8e6cd7670c62d2482d
- 3.2: 210ee47e3340d8e689d8cce584e7c918d368f16b
description: |
The smtplib module doesn't limit the amount of read data in
its call to readline(). An erroneous or malicious SMTP server can trick the
smtplib module to consume large amounts of memory.
- name: "httplib unlimited read"
slug: httplib-unlimited-read
cve: CVE-2013-1752
bpo: 6791
redhat-impact: "Moderate"
fixed-in:
- 2.7: d7b6ac66c1b81d13f2efa8d9ebba69e17c158c0a
- 3.2: ff1bbba92aad261df1ebd8fd8cc189c104e113b0
- 3.3: 5466bf1c94d38e75bc053b0cfc163e2f948fe345
description: |
Limit the HTTP header readline.
- name: "ftplib unlimited read"
slug: ftplib-unlimited-read
cve: CVE-2013-1752
bpo: 16038
links:
- https://access.redhat.com/security/cve/cve-2013-1752
redhat-impact: "Moderate"
fixed-in:
- 2.7: 2585e1e48abb3013abeb8a1fe9dccb5f79ac4091
- 3.2: c9cb18d3f7e5bf03220c213183ff0caa75905bdd
- 3.3: c30b178cbc92e62c22527cd7e1af2f02723ba679
description: |
ftplib: unlimited read from connection.
- name: "nntplib unlimited read"
slug: nntplib-unlimited-read
cve: CVE-2013-1752
bpo: 16040
links:
- https://access.redhat.com/security/cve/cve-2013-1752
redhat-impact: "Moderate"
fixed-in:
- 2.7: 42faa55124abcbb132c57745dec9e0489ac74406
- 3.2: b3ac84322fe6dd542aa755779cdbc155edca8064
description: |
Unlimited read from connection in nntplib.
- name: "poplib unlimited read"
slug: poplib-unlimited-read
cve: CVE-2013-1752
bpo: 16041
links:
- https://access.redhat.com/security/cve/cve-2013-1752
redhat-impact: "Moderate"
fixed-in:
- 2.7: faad6bbea6c86e30c770eb0a3648e2cd52b2e55e
- 3.2: eaca8616ab0e219ebb5cf37d495f4bf336ec0f5e
description: |
poplib: unlimited read from connection.
- name: "xmlrpc gzip unlimited read"
slug: xmlrpc-gzip-unlimited-read
cve: CVE-2013-1753
bpo: 16043
links:
- https://access.redhat.com/security/cve/cve-2013-1753
redhat-impact: "Moderate"
fixed-in:
- 2.7: 9e8f523c5b1c354097753084054eadf14d33238d
- 3.2: 4e9cefaf86035f8014e09049328d197b6506532f
description: |
Add a default limit for the amount of data ``xmlrpclib.gzip_decode()`` will
return.
- name: "JSONDecoder.raw_decode"
slug: jsondecoder-raw_decode
cve: CVE-2014-4616
bpo: 21529
disclosure: "2014-04-13 (commit)"
redhat-impact: "Moderate"
links:
- https://access.redhat.com/security/cve/cve-2014-4616
fixed-in:
- 2.7: 6c939cb6f6dfbd273609577b0022542d31ae2802
- 3.2: 99b5afab74428e5ddfd877bdf3aa8a8c479696b1
reported-by: Guido Vranken
description: |
Fix arbitrary memory access in ``JSONDecoder.raw_decode()`` with a negative
second parameter.
Note: The issue #21529 was created at 2014-05-19, after the commit.
- name: gettext.c2py()
slug: gettext-c2py
bpo: 28563
links:
- https://www.xil.se/post/is-eval-safe-yet-rspkt/
fixed-in:
- 2.7: a8760275bd59fb8d8be1f1bf05313fed31c08321
- 3.3: 07bcf05fcf3fd1d4001e8e3489162e6d67638285
description: |
Arbitrary code execution in ``gettext.c2py()``.
- name: "HTTPoxy attack"
slug: httpoxy
cve: CVE-2016-1000110
bpo: 27568
links:
- https://httpoxy.org/
- https://access.redhat.com/security/cve/cve-2016-1000110
reported-by: Scott Geary (HTTPoxy)
fixed-in:
- 2.7: 75d7b615ba70fc5759d16dee95bbd8f0474d8a9c
- 3.3: 4cbb23f8f278fd1f71dcd5968aa0b3f0b4f3bd5d
description: |
It was discovered that the Python ``CGIHandler`` class did not properly
protect against the ``HTTP_PROXY`` variable name clash in a CGI context.
A remote attacker could possibly use this flaw to redirect HTTP requests
performed by a Python CGI script to an attacker-controlled proxy via a
malicious HTTP request.
Ignore the ``HTTP_PROXY`` variable when ``REQUEST_METHOD`` environment is
set, which indicates that the script is in CGI mode.
CVSS score: 5.0 (CVSS v3).
- name: "socket.recvfrom_into() overflow"
slug: socket-recvfrom_into-overflow
cve: CVE-2014-1912
bpo: 20246
fixed-in:
- 2.7: 28cf368c1baba3db1f01010e921f63017af74c8f
- 3.3: fbf648ebba32bbc5aa571a4b09e2062a65fd2492
description: |
``socket.recvfrom_into()`` fails to check that the supplied buffer object
is big enough for the requested read and so will happily write off the end.
- name: "CGI directory traversal (URL parsing)"
slug: cgi-directory-traversal-url-parsing
bpo: 19435
fixed-in:
- 2.7: 1ef959ac3ddc4d96dfa1a613db5cb206cdaeb662
- 3.2: 04e9de40f380b2695f955d68f2721d57cecbf858
description: |
An error in separating the path and filename of the CGI script to run in
``http.server.CGIHTTPRequestHandler`` allows running arbitrary executables
in the directory under which the server was started.
- name: "ssl.match_hostname() wildcard DoS"
slug: ssl-match_hostname-wildcard-dos
cve: CVE-2013-2099
bpo: 17980
affected-versions:
# ssl.match_hostname() was added to Python 3.2
# The function was backported to 2.7.9 with the IDNA fix
# (commit daeb925cc88cc8fed2030166ade641de28edb396).
- '3.2'
fixed-in:
- 3.2: 86d53caddad11808ca332ab93ec35508b602a0dd
- 3.3: 636f93c63ba286249c1207e3a903f8429efb2041
description: |
If the name in the certificate contains many ``*`` characters (wildcard),
matching the compiled regular expression against the host name can take a
very long time.
Certificate validation happens before host name checking, so I think this
is a minor issue only because it can only be triggered in cooperation with
a CA (which seems unlikely).
- name: "Vulnerability in the utf-16 decoder after error handling"
slug: utf-16-decoder-after-error-handling
cve: CVE-2012-2135
bpo: 14579
disclosure: "2012-04-14"
fixed-in:
- 2.7: 715a63b78349952ccc0fb3dd3139e2d822006d35
- 3.3: b4bbee25b1e3f4bccac222f806b3138fb72439d6
description: |
Vulnerability in the UTF-16 decoder after error handling.
- name: "XML-RPC DoS"
slug: xmlrpc-dos
cve: CVE-2012-0845
bpo: 14001
fixed-in:
- 2.6: 66f3cc6f8de83c447d937160e4a1630c4482b5f5
- 3.2: ec1712a1662282c909b4cd4cc0c7486646bc9246
description: |
A denial of service flaw was found in the way Simple XML-RPC Server module
of Python processed client connections, that were closed prior the complete
request body has been received. A remote attacker could use this flaw to
cause Python Simple XML-RPC based server process to consume excessive
amount of CPU.
- name: "ssl: NULL in subjectAltNames"
slug: ssl-null-subjectaltnames
cve: CVE-2013-4238
bpo: 18709
disclosure: "2013-06-27 (Ruby issue)"
reported-by: Ryan Sleevi of the Google Chrome Security Team
fixed-in:
- 2.7: 82f88283171933127f20f866a7f98694b29cca56
- 3.2: ec3c103520a5061e657581b388e2b8ba6f74602a
- 3.3: 824f7f366d1b54d2d3100c3130c04cf1dfb4b47c
description: |
SSL module fails to handle NULL bytes inside subjectAltNames general names.
It's related to `Ruby's CVE-2013-4073
<http://www.ruby-lang.org/en/news/2013/06/27/hostname-check-bypassing-vulnerability-in-openssl-client-cve-2013-4073/>`_.
Issue #18709 reported by Christian Heimes at 2013-08-12.
- name: "ssl CBC IV attack"
slug: ssl-cbc-iv-attack
cve: CVE-2011-3389
bpo: 13885
reported-by: Apple security team
fixed-in:
- 2.6: d358e0554bc520768041652676ec8e6076f221a9
- 2.7: f2bf8a6ac51530e14d798a03c8e950dd934d85cd
description: |
The ssl module would always disable the CBC IV attack countermeasure.
Disable OpenSSL ``SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS`` option.
- name: "urllib redirect"
slug: urllib-redirect
cve: CVE-2011-1521
bpo: 11662
reported-by: email received on the Python security list
fixed-in:
- 2.5: 60a4a90c8dd2972eb4bb977e70835be9593cbbac
- 3.1: a119df91f33724f64e6bc1ecb484eeaa30ace014
description: |
The Python urllib and urllib2 modules are typically used to fetch web pages
but by default also contains handlers for ``ftp://`` and ``file://`` URL
schemes.
Now unfortunately it appears that it is possible for a web server to
redirect (HTTP 302) a urllib request to any of the supported schemes.
- name: "Sweet32 attack (DES, 3DES)"
slug: sweet32
cve: CVE-2016-2183
bpo: 27850
links:
- https://sweet32.info/
- https://www.openssl.org/blog/blog/2016/08/24/sweet32/
disclosure: "2016-08-24 (end of the Sweet32 embargo)"
reported-by: Karthik Bhargavan and Gaetan Leurent (Sweet32)
affected-versions:
# ssl._DEFAULT_CIPHERS doesn't include 3DES in 3.3 but is quite generic
- '2.7'
- '3.4'
fixed-in:
- 2.7: d988f429fe43808345812ef63dfa8da170c61871
- 3.5: 03d13c0cbfe912eb0f9b9a02987b9e569f25fe19
- 3.4: fa53dbdec818b0f2a0e22ca12a49d83ec948fc91
description: |
Remove 3DES from ssl default cipher list.
Sweet32 vulnerability found by Karthik Bhargavan and Gaetan Leurent from
the `INRIA <https://www.inria.fr/>`_.
- name: "Validate TLS certificate"
slug: validate-tls-certificate
cve: CVE-2014-9365
bpo: 22417
links:
- "`PEP 476: Enabling certificate verification by default for stdlib
http clients <https://www.python.org/dev/peps/pep-0476/>`_"
disclosure: "2014-08-28 (PEP 476 created)"
reported-by: Alex Gaynor (PEP 476 author)
fixed-in:
- 2.7: e3e7d40514e5dd0c3847682a719577efcfae1d8f
- 3.4: 4ffb0752710f0c0720d4f2af0c4b7ce1ebb9d2bd
# WONTFIX: 3.3, backward incompatible change, too late for 3.3
description: |
The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4)
xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before
3.4.3, when accessing an HTTPS URL, do not (a) check the certificate
against a trust store or verify that the server hostname matches a domain
name in the subject's (b) Common Name or (c) subjectAltName field of the
X.509 certificate, which allows man-in-the-middle attackers to spoof SSL
servers via an arbitrary valid certificate.
See also the `PEP 476 -- Enabling certificate verification by default for
stdlib http clients <https://www.python.org/dev/peps/pep-0476/>`_ and `PEP
466: Network Security Enhancements for Python 2.7.x
<https://www.python.org/dev/peps/pep-0466/>`_.
- name: "buffer() integer overflows"
slug: buffer-integer-overflows
cve: CVE-2014-7185
bpo: 21831
reported-by: Chris Foster (on the Python security list)
affected-versions:
# buffer() type was removed from Python 3
- '2.0'
fixed-in:
- 2.7: 550b945fd66f1c6837a53fbf29dc8e524297b8c3
description: |
Integer overflow in ``bufferobject.c`` in Python before 2.7.8 allows
context-dependent attackers to obtain sensitive information from process
memory via a large size and offset in a ``buffer`` type.
- name: "os.makedirs() not thread-safe"
slug: os-makedirs-not-thread-safe
cve: CVE-2014-2667
bpo: 21082
affected-versions:
# os.makedirs() exist_ok parameter added to Python 3.2
- '3.2'
fixed-in:
- 3.2: ee5f1c13d1ea21c628068fdf142823177f5526c2
description: |
``os.makedirs(exist_ok=True)`` is not thread-safe: umask is set temporary
to ``0``, serious security problem.
The fix removes the directory mode check from ``os.makedirs()``.
The ``exist_ok`` parameter was added to Python 3.2.0 (commit
5a22b651173f142a600625a036fcf36484ade237).
- name: "ssl.match_hostname() IDNA issue"
slug: ssl-match_hostname-idna
cve: CVE-2013-7440
bpo: 17997
links:
- https://tools.ietf.org/html/rfc6125
affected-versions:
# ssl.match_hostname() was added to Python 3.2
# The function was backported to 2.7.9 with the IDNA fix
# (commit daeb925cc88cc8fed2030166ade641de28edb396).
- '3.2'
fixed-in:
- 3.3: 72c98d3a761457a4f2b8054458b19f051dfb5886
description: |
``ssl.match_hostname()``: sub string wildcard should not match IDNA prefix.
Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, for
security reasons. It now doesn't match multiple wildcards nor wildcards
inside IDN fragments.
Note that this function was only added to Python 2.7 in a backport to 2.7.9,
and was added in its fixed form, so no releases of Python 2.7 have this
vulnerability.
- name: "zipfile DoS using invalid file size"
slug: zipfile-file-size-dos
cve: CVE-2013-7338
bpo: 20078
affected-versions:
# ZipExtFile._read2() was added to Python 3.3
- '3.3'
fixed-in:
- 3.3: 5ce3f10aeea711bb912e948fa5d9f63736df1327
description: |
Python before 3.3.4 RC1 allows remote attackers to cause a denial of
service (infinite loop and CPU consumption) via a file size value larger
than the size of the zip file to the functions:
* ``ZipExtFile.read()``
* ``ZipExtFile.readlines()``
* ``ZipFile.extract()``
* ``ZipFile.extractall()``
Reading malformed zipfiles no longer hangs with 100% CPU consumption.
Python 2.7 is not affected.
- name: "Hash function not randomized properly"
slug: hash-function-not-randomized-properly
cve: CVE-2013-7040
bpo: 14621
fixed-in:
- 3.4: 985ecdcfc29adfc36ce2339acf03f819ad414869
description: |
The hash function is not randomized properly.
Python 3.4 now used SipHash (PEP 456).
Python 3.3 and Python 2.7 are still affected.
- name: "pypirc created insecurely"
slug: pypirc-created-insecurely
cve: CVE-2011-4944
bpo: 13512
fixed-in:
- 2.6: e5567ccc863cadb68f5e57a2760e021e0d3807cf
- 3.3: d61926e6bef6c4d8105a2848362377dce91d7fc8
description: |
Python 2.6 through 3.2 creates ``~/.pypirc`` configuration file with
world-readable permissions before changing them after data has been
written, which introduces a race condition that allows local users to
obtain a username and password by reading this file.
- name: "SimpleHTTPServer UTF-7"
slug: simplehttpserver-utf-7
cve: CVE-2011-4940
bpo: 11442
reported-by: email received on the Python security list
fixed-in:
- 2.5: 3853586e0caa0d5c4342ac8bd7e78cb5766fa8cc
description: |
The ``list_directory()`` function in ``Lib/SimpleHTTPServer.py`` in
``SimpleHTTPServer`` in Python before 2.5.6c1, 2.6.x before 2.6.7 rc2, and
2.7.x before 2.7.2 does not place a charset parameter in the Content-Type
HTTP header, which makes it easier for remote attackers to conduct
cross-site scripting (XSS) attacks against Internet Explorer 7 via UTF-7
encoding.
- name: "CGI directory traversal (is_cgi() function)"
slug: cgi-directory-traversal-is_cgi
cve: CVE-2011-1015
bpo: 2254
fixed-in:
- 2.7: 923ba361d8f757f0656cfd216525aca4848e02aa
description: |
The ``is_cgi()`` method in ``CGIHTTPServer.py`` in the ``CGIHTTPServer``
module in Python 2.5, 2.6, and 3.0 allows remote attackers to read script
source code via an HTTP GET request that lacks a ``/`` (slash) character at
the beginning of the URI.
- name: "smtpd accept bug and race condition"
slug: smtpd-accept-bug-and-race-condition
cve:
- CVE-2010-3492
- CVE-2010-3493
bpo: 6706
fixed-in:
- 2.7: 19e9fefc660d623ce7c31fb008cde1157ae12aba
- 3.1: 5ea3d0f95b51009fa1c3409e7dd1c12006427ccc
- 3.2: 977c707b425ee753d54f3e9010f07ec77ef61274
description: |
CVE-2010-3492: The ``asyncore`` module in Python before 3.2 does not properly handle
unsuccessful calls to the accept function, and does not have accompanying
documentation describing how daemon applications should handle unsuccessful
calls to the accept function, which makes it easier for remote attackers to
conduct denial of service attacks that terminate these applications via
network connections.
CVE-2010-3493: Multiple race conditions in ``smtpd.py`` in the ``smtpd`` module in Python 2.6,
2.7, 3.1, and 3.2 alpha allow remote attackers to cause a denial of
service (daemon outage) by establishing and then immediately closing a TCP
connection, leading to the accept function having an unexpected return
value of None, an unexpected value of None for the address, or an
ECONNABORTED, EAGAIN, or EWOULDBLOCK error, or the getpeername function
having an ENOTCONN error, a related issue to CVE-2010-3492.
- name: "audioop input validation"
slug: audioop-input-validation
cve: CVE-2010-2089
bpo: 7673
fixed-in:
- 2.6: e9123efa21a16584758b5ce7da93d3966cf0cd81
- 3.1: 8e42fb7ada3198e66d3f060c5c87c52465a86e36
- 3.2: bc5c54bca24fdb1fcf7fa055831ec997a65f3ce8
description: |
The ``audioop`` module in Python 2.7 and 3.2 does not verify the relationships
between size arguments and byte string lengths, which allows
context-dependent attackers to cause a denial of service (memory corruption
and application crash) via crafted arguments, as demonstrated by a call to
``audioop.reverse()`` with a one-byte string, a different vulnerability
than CVE-2010-1634.
- name: "audioop integer overflows"
slug: audioop-integer-overflows
cve: CVE-2010-1634
bpo: 8674
fixed-in:
- 2.6: 7ceb497ae6f554274399bd9916ea5a21de443208
- 2.7: 11bb2cdc6aa8db142a87de281b83293d500847b2
- 3.1: ee289e6cd5c009e641ee970cfc67996d8f871221
- 3.2: 393b97a7b61583f3e0401f385da8b741ef1684d6
description: |
Multiple integer overflows in ``audioop.c`` in the ``audioop`` module in Python
2.6, 2.7, 3.1, and 3.2 allow context-dependent attackers to cause a denial
of service (application crash) via a large fragment, as demonstrated by a
call to audioop.lin2lin with a long string in the first argument, leading
to a buffer overflow.
NOTE: this vulnerability exists because of an incorrect fix for
CVE-2008-3143.
- name: "rgbimg and imageop overflows"
slug: rgbimg-imageop-overflows
cve:
- CVE-2007-4965
- CVE-2009-4134
- CVE-2010-1449
- CVE-2010-1450
bpo: 1179
links:
- http://seclists.org/fulldisclosure/2007/Sep/279
- http://bugs.python.org/issue8678
- https://bugzilla.redhat.com/show_bug.cgi?id=541698
disclosure: "2007-09-16 (full-disclosure email)"
reported-by: Slythers Bro (on the full-disclosure mailing list)
# imageop module was removed in Python 3
ignore-python3: true
affected-versions:
# rgbimg and imageop modules were removed in Python 3
- '2.0'
fixed-in:
- 2.5: 4df1b6d478020ac51c84467f47e42083f53adbad
- 2.6: 93ebfb154456daa841aa223bd296422787b3074c
description: |
Multiple integer overflows in the ``imageop`` module in Python 2.5.1 and
earlier allow context-dependent attackers to cause a denial of service
(application crash) and possibly obtain sensitive information (memory
contents) via crafted arguments to (1) the ``tovideo()`` method, and
unspecified other vectors related to (2) ``imageop.c``, (3)
``rbgimgmodule.c``, and other files, which trigger heap-based buffer
overflows.
Reported again by Marc Schoenefeld in the Red Hat
bugzilla at 2009-11-26.
- name: "Multiple integer overflows (Google)"
slug: multiple-integer-overflows-google
cve: CVE-2008-3143
bpo: 2620
fixed-in:
- 2.5: 83ac0144fa3041556aa4f3952ebd979e0189a19c
- 2.6: 0470bab69783c13447cb634fa403ef1067fe56d1
- 3.1: d492ad80c872d264ed46bec71e31a00f174ac819
description: |
Multiple integer overflows in Python before 2.5.2 might allow
context-dependent attackers to have an unknown impact via vectors related
to:
* ``Include/pymem.h``
* ``Modules/``:
- ``_csv.c``
- ``_struct.c``
- ``arraymodule.c``
- ``audioop.c``
- ``binascii.c``
- ``cPickle.c``
- ``cStringIO.c``
- ``datetimemodule.c``
- ``md5.c``
- ``rgbimgmodule.c``
- ``stropmodule.c``
* ``Modules/cjkcodecs/multibytecodec.c``
* ``Objects/``:
- ``bufferobject.c``
- ``listobject.c``
- ``obmalloc.c``
* ``Parser/node.c``
* ``Python/``:
- ``asdl.c``
- ``ast.c``
- ``bltinmodule.c``
- ``compile``
as addressed by "checks for integer overflows, contributed by Google."
- name: "expandtab() integer overflow"
slug: expandtab-integer-overflow
cve: CVE-2008-5031
links:
- http://scary.beasts.org/security/CESA-2008-008.html
disclosure: "2008-03-11 (commit date)"
reported-by: Chris Evans
fixed-in:
- 2.5: 44a93e54f4b0f90634d16d53c437fabb6946ea9d
- 2.6: 5bdff60617e6fc1d2e387a0b165cb23b82d7dae6
- 3.0: dd15f6c315f20c1a9a540dd757cd63e27dbe9f3c
description: |
Multiple integer overflows in Python 2.2.3 through 2.5.1, and 2.6, allow
context-dependent attackers to have an unknown impact via a large integer
value in the tabsize argument to the expandtabs method, as implemented by:
* the ``string_expandtabs()`` function in ``Objects/stringobject.c``
* the ``unicode_expandtabs()`` function in ``Objects/unicodeobject.c``
NOTE: this vulnerability reportedly exists because of an incomplete
fix for CVE-2008-2315.
- name: "Multiple integer overflows (Apple)"
slug: multiple-integer-overflows-apple
cve:
- CVE-2008-1679
- CVE-2008-1721
- CVE-2008-1887
- CVE-2008-2315
- CVE-2008-2316
- CVE-2008-3142
- CVE-2008-3144
- CVE-2008-4864
links:
- https://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html
disclosure: "2008-07-31 (commit)"
reported-by: Apple
fixed-in:
- 2.6: e7d8be80ba634fa15ece6f503c33592e0d333361
- 2.7: 3ce5d9207e66d61d4b0502cf47ed2d2bcdd2212f
description: |
Security patches from Apple: prevent integer overflows when allocating
memory.
CVE-ID:
* CVE-2008-1679 (``imageop``)
* CVE-2008-1721 (``zlib``)
* CVE-2008-1887 (``PyString_FromStringAndSize()``)
* CVE-2008-2315
* CVE-2008-2316 (``hashlib``)
* CVE-2008-3142 (``unicode_resize()``, ``PyMem_RESIZE()``)
* CVE-2008-3144 (``PyOS_vsnprintf()``)
* CVE-2008-4864 (``imageop``)
- name: "Expat 2.2 (Expat bug #537)"
slug: expat-2.2
cve:
- CVE-2016-0718
- CVE-2016-4472
# Bug number at bugs.python.org (bpo)
bpo: 29591
links:
- https://sourceforge.net/p/expat/bugs/537/
- https://bugs.python.org/issue30610
reported-by: "2016-05-27 (expat bug #537 reported)"
fixed-in:
- 3.7: 23ec4b57e1359f9c539b8defc317542173ae087e
- 3.6: 86b95370c45dedb8a56c9894372a43681de47a73
- 3.5: 8c797ed8a0fea5e3162b9415f13e270d4d5d9549
- 3.4: 71572bbe82aa0836c036d44d41c8269ba6a321be
- 3.3: ab90986600ba7dea2aa41e5c1773791070725453
- 2.7: 0e4571a68a7f48e8469ef05b04ba3463d3fd82c0
description: |
The Expat XML parser mishandles certain kinds of malformed input documents,
resulting in buffer overflows during processing and error reporting. The
overflows can manifest as a segmentation fault or as memory corruption
during a parse operation. The bugs allow for a denial of service attack in
many applications by an unauthenticated attacker, and could conceivably
result in remote code execution.
- name: "Expat 2.2.1"
slug: expat-2.2.1
cve:
- CVE-2017-9233
- CVE-2016-9063
- CVE-2016-0718
- CVE-2012-0876
bpo: 30694
links:
- https://libexpat.github.io/doc/cve-2017-9233/
- https://github.com/libexpat/libexpat/blob/R_2_2_1/expat/Changes
disclosure: "2017-06-17 (Expat 2.2.1 release)"
fixed-in:
- 3.7: 5ff7132313eb651107b179d20218dfe5d4e47f13
- 3.6: ea1ab803ddc14ab02ffed50ecc5089897f259623
- 3.5: 91d171be45942d37a973b0675521b5159a96be31
- 3.4: 71572bbe82aa0836c036d44d41c8269ba6a321be
- 3.3: ab90986600ba7dea2aa41e5c1773791070725453
- 2.7: 2ada64d2a073f85f135461833952dbe8d656810d
description: |
Upgrade expat copy from 2.2.0 to 2.2.1 to get fixes of multiple security
vulnerabilities including:
* CVE-2017-9233 (External entity infinite loop DoS),
* CVE-2016-9063 (Integer overflow, re-fix),
* CVE-2016-0718 (Fix regression bugs from 2.2.0’s fix to CVE-2016-0718)
* CVE-2012-0876 (Counter hash flooding with SipHash).
Note: the CVE-2016-5300 (Use os-specific entropy sources like getrandom)
doesn’t impact Python, since Python already gets entropy from the OS to set
the expat secret using ``XML_SetHashSalt()``.
- name: "Environment variables injection in subprocess on Windows"
slug: env-var-injection-subprocess-windows
bpo: 30730
fixed-in:
- 3.7: d174d24a5d37d1516b885dc7c82f71ecd5930700
- 3.6: a9b16cff35811f88cdfeb4f50758140dfff36ebc
- 3.5: a7c0264735f46afab13771be4218d8eab0d7dc91
- 3.4: fe82c46327effc124ff166e1fa1e611579e1176b
- 3.3: e46f1c19642ea1882f427d8246987ba49351a97d
- 2.7: 9dda2caca8edc7ff1285f6b0d1c5279b51854b7d
description: |
On Windows, prevent passing invalid environment variables and command
arguments to subprocess.Popen.
It is possible to inject an environment variable in subprocess on Windows
if a user data is passed to a subprocess via environment variable.
Check for invalid environment (variable names containing '=') and command
arguments (containing '\0').
- name: "Zlib 1.2.11"
slug: zlib-1.2.11
cve:
- CVE-2016-9840
- CVE-2016-9841
- CVE-2016-9842
- CVE-2016-9843
bpo: 29169
reported-at: "2017-01-02 (zlib 1.2.10 released)"
fixed-in:
- 2.7: 80b24a9354c60f6b800d462c941c6d4cde3cf783
- 3.4: d0e61bded5256e775e470e2c0da22367a1a81970
- 3.5: 34e7e2ecb1741850190e78f42875480693d3537b
# Python 3.3 uses zlib 1.2.5 and is not going to be fixed:
# https://github.com/python/cpython/pull/3108
description: |
These are the changes updating zlib from 1.2.8 to 1.2.10. It is only used
when building without a system zlib.
The new release includes fixes for
security issues CVE-2016-9840, CVE-2016-9841, CVE-2016-9842, CVE-2016-9843.
Note: Only Windows and macOS are affected by this issue. Linux packages use
the system zlib.
- name: "Expat 2.2.3"
slug: expat-2.2.3
bpo: 30947
fixed-in:
- 2.7: ec4ab09b7c0b5070bdb27351f979cbecc4636245
- 3.3: 297516ea509c72d8ebed3a9b3ce200f023aca0b7 # expat 2.2.1 to 2.2.4
- 3.4: 86a713cb0c110b6798ca7f9e630fc511ee0a4028
- 3.5: f2492bb6aae061aea47e21fc7e56b7ab9bfdf543
- 3.6: 83e37e16f3065086d721d4e62a3788e01db3431c
- 3.7: 93d0cb58b4da2a88c56f472c6c19491cc7a390df
description: |
Expat 2.2.2 was released with multiple security fixes:
* #43: Protect against compilation without any source of high quality
entropy enabled, e.g. with CMake build system
* #60: Windows with _UNICODE: Unintended use of LoadLibraryW with a non-wide
string resulted in failure to load advapi32.dll and degradation in quality
of used entropy when compiled with _UNICODE for Windows; you can launch
existing binaries with EXPAT_ENTROPY_DEBUG=1 in the environment to inspect
the quality of entropy used during runtime
* [MOX-006]: Fix non-NULL parser parameter validation in XML_Parse; resulted
in NULL dereference, previously
Expat 2.2.3 contains an additional security fix: #82: CVE-2017-11742 --
Windows: Fix DLL hijacking vulnerability using Steve Holme's LoadLibrary
wrapper for/of cURL
- name: "PyString_DecodeEscape integer overflow"
slug: pystring_decodeescape-integer-overflow
cve: CVE-2017-1000158
bpo: 30657
fixed-in:
- 2.7: c3c9db89273fabc62ea1b48389d9a3000c1c03ae
- 3.4: 6c004b40f9d51872d848981ef1a18bb08c2dfc42
- 3.5: fd8614c5c5466a14a945db5b059c10c0fb8f76d9
affected-versions:
# <2.7 and <3.4 is likely impacted as well
- '2.7'
- '3.4'
- '3.5'
description: |
Check & prevent integer overflow in PyString_DecodeEscape.
You need to compile a 1 GiB Python file on 32-bit system for reproducing
it. It is very unlikely that this can happen by accident, and it is hard to
used it in security attack. If you can make the attacked program compiling
a 1 GiB Python file, you perhaps have easier ways to make a harm.
- name: "Buffer overflow vulnerability in os.symlink on Windows"
slug: buffer-overflow-os-symlink-windows
cve: CVE-2018-1000117
bpo: 33001
links:
- https://mail.python.org/mm3/archives/list/[email protected]/thread/PVSURQ2YCNZODILA3QE7ZF3GCD25EVVT/
reported-at: "2018-02-27 (email to the PSRT)"
reported-by: "Alexey Izbyshev"
affected-versions:
# os.symlink() is not available on Windows in Python 2.7
- "3.2"
fixed-in:
- 3.8: 6921e73e33edc3c61bc2d78ed558eaa22a89a564
- 3.7: 96fdbacb7797a564249fd59ccf86ec153c4bb095
- 3.6: baa45079466eda1f5636a6d13f3a60c2c00fdcd3
- 3.4: 77c02cdce2d7b8360771be35b7676a4977e070c1
- 3.5: f381cfe07d15d52f27de771a62a8167668f0dd51
description: |
On February 27th, 2018, the Python Security Response team was notified
of a buffer overflow issue in the ``os.symlink()`` method on Windows. The
issue affects all versions of Python between 3.2 and 3.6.4, including
the 3.7 beta releases. It has been patched for the next releases of 3.4,
3.5, 3.6 and 3.7.
Scripts may be vulnerable if they use ``os.symlink()`` on Windows and an
attacker is able to influence the location where links are created. As
os.symlink requires additional privileges, exploits using this
vulnerability are more likely to result in escalation of privilege.
Besides applying the fix to CPython, scripts can also ensure that the
length of each path argument is less than 260, and if the source is a
relative path, that its combination with the destination is also shorter
than 260 characters. That is::
assert (len(src) < 260 and
len(dest) < 260 and
len(os.path.join(os.path.dirname(dest), src)) < 260)
os.symlink(src, dest)