Threat database

A use-after-free vulnerability exists in Python's decompression modules lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile when a MemoryError occurs during decompression and the decompressor instance is reused. This flaw can lead to arbitrary code execution or information disclosure. The vulnerability only affects scenarios where decompressor instances are reused after a MemoryError; one-shot decompression helper functions are not affected. A patch is available to address this issue.

CVE-2024-12718 is a path traversal vulnerability in the Python tarfile module affecting Python versions 3.12 and later. It allows modification of file metadata or permissions outside the intended extraction directory when using the extractall() or extract() methods with the filter parameter set to "data" or "tar". The default filter changed to "data" starting in Python 3.14, increasing the risk if relying on default behavior. This vulnerability does not significantly impact source distribution installations, which already permit arbitrary code execution during builds.

A vulnerability in Python versions prior to 3.8.18, 3.9.18, 3.10.13, and 3.11.5 affects servers using TLS client authentication. When a TLS server-side socket is created, receives data, and is then closed quickly, there is a brief window where buffered data can be read without authentication. This data is indistinguishable from valid TLS stream data but is limited in size to the socket buffer. The issue arises because the SSLSocket instance detects the socket as not connected and does not initiate a handshake, leaving buffered data unauthenticated.

An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.