CVSS: 7.1EPSS: 0%CPEs: 15EXPL: 1CVE-2020-8492 – python: wrong backtracking in urllib.request.AbstractBasicAuthHandler allows for a ReDoS
https://notcve.org/view.php?id=CVE-2020-8492
Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking. Python versiones 2.7 hasta 2.7.17, versiones 3.5 hasta 3.5.9, versiones 3.6 hasta 3.6.10, versiones 3.7 hasta 3.7.6 y versiones 3.8 hasta 3.8.1, permiten a un servidor HTTP conducir ataques de Denegación de Servicio de Expresión Regular (ReDoS) contra un cliente debido a un backtracking catastrófico de la clase urllib.request.AbstractBasicAuthHandler. • http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00003.html https://bugs.python.org/issue39503 https://github.com/python/cpython/pull/18284 https://lists.apache.org/thread.html/rdb31a608dd6758c6093fd645aea3fbf022dd25b37109b6aaea5bc0b5%40%3Ccommits.cassandra.apache.org%3E https://lists.apache.org/thread.html/rfec113c733162b39633fd86a2d0f34bf42ac35f711b3ec1835c774da%40%3Ccommits.cassandra.apache.org%3E https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html https://lists.debian.org/debian-lts-announce/2023/05& • CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-8315
https://notcve.org/view.php?id=CVE-2020-8315
In Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an insecure dependency load upon launch on Windows 7 may result in an attacker's copy of api-ms-win-core-path-l1-1-0.dll being loaded and used instead of the system's copy. Windows 8 and later are unaffected. En Python (CPython) versiones 3.6 hasta 3.6.10, 3.7 hasta 3.7.6 y 3.8 hasta 3.8.1, una carga de dependencia no segura al iniciarse en Windows 7 puede resultar en una copia del atacante de api-ms-win-core-path- l1-1-0.dll siendo cargada y usada en lugar de la copia del sistema. Windows 8 y versiones posteriores no están afectadas. • https://bugs.python.org/issue39401 • CWE-427: Uncontrolled Search Path Element •
CVSS: 7.5EPSS: 1%CPEs: 3EXPL: 0CVE-2013-1895
https://notcve.org/view.php?id=CVE-2013-1895
The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten. El módulo py-bcrypt versiones anteriores a 0.3 para Python, no maneja apropiadamente el acceso concurrente a la memoria, que permite a atacantes omitir la autenticación por medio de múltiples peticiones de autenticación, lo que desencadena que el hash de contraseña se sobrescriba. • http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101382.html http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101387.html http://www.openwall.com/lists/oss-security/2013/03/26/2 http://www.securityfocus.com/bid/58702 https://exchange.xforce.ibmcloud.com/vulnerabilities/83039 • CWE-307: Improper Restriction of Excessive Authentication Attempts •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2009-3724
https://notcve.org/view.php?id=CVE-2009-3724
python-markdown2 before 1.0.1.14 has multiple cross-site scripting (XSS) issues. python-markdown2 versiones anteriores a la versión 1.0.1.14, tiene múltiples problemas de tipo cross-site scripting (XSS) . • https://snyk.io/vuln/SNYK-PYTHON-PYRAD-40000 https://www.openwall.com/lists/oss-security/2009/10/29/5 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 8EXPL: 0CVE-2019-19911 – python-pillow: uncontrolled resource consumption in FpxImagePlugin.py
https://notcve.org/view.php?id=CVE-2019-19911
There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows running 32-bit Python, this results in an OverflowError or MemoryError due to the 2 GB limit. However, on Linux running 64-bit Python this results in the process being terminated by the OOM killer. Hay una vulnerabilidad DoS en Pillow versiones anteriores a la versión 6.2.2, causada por el archivo FpxImagePlugin.py llamando a la función range en un entero de 32 bits sin validar si el número de bandas es grande. En Windows ejecutando Python de 32 bits, esto resulta en un OverflowError o MemoryError debido al límite de 2 GB. • https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html https://usn.ubuntu.com/4272-1 https://www.debian.org/security/2020/dsa-4631 https://access.redhat.com/security/cve/CVE-2019-19911 https://bugzilla.redhat.com/show_bug.cgi?id=1789540 • CWE-190: Integer Overflow or Wraparound CWE-400: Uncontrolled Resource Consumption •