Threats affecting pkg:github/CPython

When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.

The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.

The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.

User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.

When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized.

CVE-2024-3220 is a low-severity vulnerability in the Python CPython standard library module mimetypes affecting Windows platforms. The issue arises because mimetypes uses default file locations that are writable by users on Windows, allowing creation of invalid files that can cause a MemoryError during Python startup or incorrect file type interpretation. This occurs due to Linux/macOS default paths being used on Windows where they are user-writable. The vulnerability is fixed in CPython versions 3.11.18, 3.12.16, 3.13.18, 3.14.9, 3.15.1, and 3.16.0. A workaround is to call mimetypes.init() with an empty list on Windows to avoid using the default writable locations.

Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the write buffer potentially leading to memory exhaustion. This vulnerability likely impacts a small number of users, you must be using Python 3.12.0 or later, on macOS or Linux, using the asyncio module with protocols, and using .writelines() method which had new zero-copy-on-write behavior in Python 3.12.0 and later. If not all of these factors are true then your usage of Python is unaffected.