The aiohttp server component in Lexicon versions >=3.25.2_3 and <3.25.2_5 lacks an initial request/header timeout, allowing an attacker to keep an idle connection open indefinitely before sending any data. This issue has been fixed in version 3.25.2_5. The vulnerability has a high severity with a CVSS score of 8.2. A recommended workaround is to use a reverse proxy with sensible keepalive limits.
A vulnerability in AIOHTTP allows the Secure attribute of a shared cookie to not be enforced, potentially causing the cookie to be sent over unencrypted requests. This flaw affects versions from 3.25.2_3 up to but not including 3.25.2_5 and has a medium severity rating. A fix is available in version 3.25.2_5.
The Model Context Protocol (MCP) Python SDK versions 1.10.0 through 1.29.1 and 2.0.0 through 2.1.1 have a vulnerability where the client fetches server-chosen external $ref URLs during tool output schema validation. This can cause the client to make network or local file requests synchronously without timeout, potentially freezing the client session. The issue is fixed in versions 1.30.0 and 2.2.0, which restrict reference resolution to within the schema document only.
PyJWT versions up to 2.13.0 and current master before 2.26.0 contain a vulnerability where the HMAC verification accepts an empty key when using octet JWKs. This allows an attacker to forge tokens without knowing any secret if the application verifies tokens using a JWK/JWKS with an empty 'k' value. The issue arises because the empty key rejection implemented for string/bytes keys is not applied to keys loaded from JWKs. The vulnerability is fixed in PyJWT version 2.26.0.
The Model Context Protocol (MCP) Python SDK versions 1.8.0 through 1.29.1 and 2.0.0 through 2.1.1 have a vulnerability where HTTP client transports follow cross-origin redirects and send custom headers and, on 307/308 redirects, the request body to the redirected host. This can expose sensitive headers like X-API-Key if an attacker can cause a trusted endpoint to redirect to a malicious host. The Authorization bearer header is not exposed due to HTTP library protections. The issue is fixed in MCP SDK versions 3.0.3 and later.
A vulnerability in OpenTelemetry Python's opentelemetry-api package causes quadratic CPU cost when parsing the W3C tracestate header due to an unbounded optional-whitespace regular expression. This can lead to denial of service by blocking server workers for several seconds when processing large tracestate headers with many spaces or tabs. The issue affects versions from 1.0.0 through versions before 3.0.3. A fix is available in version 3.0.3.
Mistral vibe's GitPython integration has a vulnerability where the submodule creation function clones into the .git/hooks directory before validating the path. This allows an attacker to plant an executable hook script that runs on subsequent git operations, leading to arbitrary code execution. The issue affects versions from 2.1.0 up to but not including 3.0.3. Although versions 3.2.0 and later added stricter validation, the check occurs too late to prevent the malicious hook from being written. Versions 3.1.x do not perform this validation at all and silently allow the attack.
GitPython's Submodule.move() API does not properly handle symbolic links in intermediate path components, allowing an attacker-controlled symlink in a cloned repository to redirect submodule moves outside the parent repository worktree. This can cause the submodule checkout to be moved to an attacker-selected directory outside the worktree, corrupting the parent repository's index and configuration. The vulnerability requires the application to call Submodule.move() explicitly with a path under the symlink and affects GitPython versions before 3.0.3. No code execution or confidentiality impact is demonstrated.
GitPython versions up to 3.1.62 contain a vulnerability in the Head.checkout() method that allows an attacker to cause an arbitrary file read via a specially crafted branch name. The flaw arises because the branch name is passed as a positional argument to git checkout without proper sanitization or argument separation, enabling injection of git command options such as --pathspec-from-file. This can cause the contents of arbitrary files readable by the application process to be returned in exceptions. The issue is a regression or incomplete fix of prior advisories and affects all published releases up to 3.1.62. A fix is available in version 3.0.3.
GitPython's Remote.pull() method improperly handles the positional refspec argument, allowing an attacker to inject a --upload-pack option that bypasses the unsafe-option guard. This leads to arbitrary command execution with the privileges of the calling process when pulling from local-path or SSH transports. The vulnerability affects versions from 2.1.0 up to but not including 3.0.3 and is fixed in version 3.0.3.
GitPython versions >=2.1.0 and <3.0.3 contain vulnerabilities where three wrapper methods omit necessary unsafe protocol and option checks. The ls_remote method does not check for unsafe protocols, allowing remote code execution (RCE) if the victim's git transport policy permits the 'ext' protocol. The merge_base and IndexFile.move methods forward caller arguments without proper unsafe option checks, creating latent injection surfaces. These issues were verified on the main branch post the latest release. A fix is available in version 3.0.3.
Mistral vibe's GitPython parse_actor_and_date() function has a regex vulnerability causing quadratic backtracking on malformed author/committer/tagger lines missing or having malformed trailing epoch or timezone data. This leads to CPU exhaustion when processing crafted commit or tag objects. The issue affects versions from 2.1.0 up to but not including 3.0.3. A patch fixing the regex to prevent backtracking is available in version 3.0.3. The vulnerability can cause significant delays (seconds per access) in applications using GitPython to read untrusted repositories.
GitPython versions 2.1.0 up to but not including 3.0.3 contain a vulnerability where environment variables can be expanded from attacker-controlled .gitmodules submodule names during cloning operations. This leads to leakage of environment variable values both as persistent directory names on disk and in debug-level logs. The issue arises because the _clone() method does not disable environment variable expansion in Git.polish_url() for the separate_git_dir argument, unlike other similar calls. A fix is available in version 3.0.3.
Multiple security vulnerabilities have been identified and fixed in the Apache HTTP Server (httpd) 2.4 packages provided by Red Hat Enterprise Linux 8. These include authentication bypasses, denial of service conditions, arbitrary code execution, HTTP response smuggling, and unauthorized connections to arbitrary hosts. The update addresses these issues to improve the security and stability of the httpd server.
A vulnerability in the bash activator script of virtualenv allows an attacker controlling the --prompt value to execute arbitrary commands. This occurs because the prompt value is inserted unescaped into the PS1 variable when the bash shell option promptvars is off, but can be re-enabled later, causing command substitution to run. This regression was introduced in virtualenv 21.14.9 and persists through 21.14.12. The issue affects activation scripts, specifically bash's bin/activate, and can lead to command execution as the user activating the environment.
The msgpack-python C extension has an unbounded memory leak when deserializing MessagePack data with strict_map_key validation enabled (default). This occurs because a decoded map value is leaked when a key is rejected, causing memory growth and potential denial of service. Additionally, the streaming Unpacker API may suffer from use-after-free crashes due to stale parser-stack references. The issue affects version 1.2.2 and development commits, with a fix available in version 2.5.1_1.
A code injection vulnerability exists in Poetry's virtualenv activation scripts due to improper handling of placeholder names in environment paths or prompts. When a path contains a placeholder name such as __VIRTUAL_NAME__, the activation script may execute arbitrary shell commands during environment activation. This affects versions from 1.8.3_2 up to but not including 2.5.1_1. The issue is fixed in version 2.5.1_1.
A command injection vulnerability exists in Poetry's virtualenv activate.fish script due to improper quoting of paths or prompts containing backslashes before quotes. This allows fish shell to interpret and execute injected commands when sourcing activate.fish. The issue affects all Poetry releases up to 1.2.2_1 and 2.5.1_1 that ship activate.fish. It was fixed in versions 1.2.2_1 and 2.5.1_1 by properly escaping backslashes and single quotes in activate.fish.