{"schema_version":"2","view":"grouped","data":[{"id":57175,"cve_ids":["CVE-2026-115557"],"payload":{"kind":"advisory","title":"Distrust compromised intermediate certificates in ssl module","summary":"Python has added a denylist for known compromised certificates to the \"ssl\" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.","evidence":"cve:CVE-2026-115557","products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-115557","aliases":["CVE-2026-115557"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":9.4,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"CRITICAL","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/python/cpython","vendor":"Python Software Foundation","modules":["ssl"],"product":"CPython","versions":[{"status":"affected","version":"0","lessThan":"3.16.0","versionType":"python"}],"defaultStatus":"unaffected"}],"modified":"2026-10-25T00:39:26.520Z","provider":"cve","references":["https://github.com/python/cpython/pull/160042","https://github.com/python/cpython/issues/160040","https://emudhra.we-have-a-problem.com/","https://mail.python.org/archives/list/security-announce@python.org/thread/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/","https://github.com/python/cpython/commit/21a50891ab4be2e9955239e625ae2b40c6b1854d","https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd","https://github.com/python/cpython/commit/48d9b2712cd52206c7a5882d0fdca4863ed65e93","https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6","https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5","https://github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5b","https://github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90","https://github.com/python/cpython/commit/c7fd7edf7e0d122a3973cf676fae21b6aaa650a8","https://github.com/python/cpython/commit/e2a9dd97ef9571c710ac0afaa834c8879aebce78","https://github.com/python/cpython/commit/e4500d8a437ee5b988a5410cb9b59d177aa01370","https://github.com/python/cpython/commit/e4f63e65a93cf44c14274aa987e644b8c003625e","https://github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/24/5"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-24T18:07:53.662Z"}}],"cna":{"orgId":"28c92f92-d60d-412d-b760-e73465c3df22","shortName":"PSF","dateUpdated":"2026-10-25T00:39:26.520Z"}}},"related_cves":[{"value":"CVE-2026-115557","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:cde9c1fe-8101-4c33-906b-d22487b77bf0","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115557","advisory_id":"cde9c1fe-8101-4c33-906b-d22487b77bf0","event_types":["advisory"],"published_at":"2026-10-25T16:46:07.800219+00:00","technologies":["core-cve","cpython"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T14:15:14.283+00:00","detail_url":"/advisories/advisory%3Acde9c1fe-8101-4c33-906b-d22487b77bf0","group":{"id":"advisory:cde9c1fe-8101-4c33-906b-d22487b77bf0","revision":1,"primary_event_id":56689,"change":"published","superseded_by":[],"changed":{"id":56689,"cve_ids":["CVE-2026-115557"],"payload":{"kind":"advisory","title":"Distrust compromised intermediate certificates in ssl module","summary":"Python has added a denylist for known compromised certificates to the \"ssl\" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.","evidence":"cve:CVE-2026-115557","products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-115557","aliases":["CVE-2026-115557"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":9.4,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"CRITICAL","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/python/cpython","vendor":"Python Software Foundation","modules":["ssl"],"product":"CPython","versions":[{"status":"affected","version":"0","lessThan":"3.16.0","versionType":"python"}],"defaultStatus":"unaffected"}],"modified":"2026-10-25T00:39:26.520Z","provider":"cve","references":["https://github.com/python/cpython/pull/160042","https://github.com/python/cpython/issues/160040","https://emudhra.we-have-a-problem.com/","https://mail.python.org/archives/list/security-announce@python.org/thread/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/","https://github.com/python/cpython/commit/21a50891ab4be2e9955239e625ae2b40c6b1854d","https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd","https://github.com/python/cpython/commit/48d9b2712cd52206c7a5882d0fdca4863ed65e93","https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6","https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5","https://github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5b","https://github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90","https://github.com/python/cpython/commit/c7fd7edf7e0d122a3973cf676fae21b6aaa650a8","https://github.com/python/cpython/commit/e2a9dd97ef9571c710ac0afaa834c8879aebce78","https://github.com/python/cpython/commit/e4500d8a437ee5b988a5410cb9b59d177aa01370","https://github.com/python/cpython/commit/e4f63e65a93cf44c14274aa987e644b8c003625e","https://github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/24/5"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-24T18:07:53.662Z"}}],"cna":{"orgId":"28c92f92-d60d-412d-b760-e73465c3df22","shortName":"PSF","dateUpdated":"2026-10-25T00:39:26.520Z"}}},"related_cves":[{"value":"CVE-2026-115557","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:cde9c1fe-8101-4c33-906b-d22487b77bf0","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115557","advisory_id":"cde9c1fe-8101-4c33-906b-d22487b77bf0","event_types":["advisory"],"published_at":"2026-10-25T16:46:07.800219+00:00","technologies":["core-cve","cpython"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T14:15:14.283+00:00","detail_url":"/events/56689"},"members":[{"id":56689,"cve_ids":["CVE-2026-115557"],"payload":{"kind":"advisory","title":"Distrust compromised intermediate certificates in ssl module","summary":"Python has added a denylist for known compromised certificates to the \"ssl\" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.","evidence":"cve:CVE-2026-115557","products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-115557","aliases":["CVE-2026-115557"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":9.4,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"CRITICAL","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/python/cpython","vendor":"Python Software Foundation","modules":["ssl"],"product":"CPython","versions":[{"status":"affected","version":"0","lessThan":"3.16.0","versionType":"python"}],"defaultStatus":"unaffected"}],"modified":"2026-10-25T00:39:26.520Z","provider":"cve","references":["https://github.com/python/cpython/pull/160042","https://github.com/python/cpython/issues/160040","https://emudhra.we-have-a-problem.com/","https://mail.python.org/archives/list/security-announce@python.org/thread/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/","https://github.com/python/cpython/commit/21a50891ab4be2e9955239e625ae2b40c6b1854d","https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd","https://github.com/python/cpython/commit/48d9b2712cd52206c7a5882d0fdca4863ed65e93","https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6","https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5","https://github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5b","https://github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90","https://github.com/python/cpython/commit/c7fd7edf7e0d122a3973cf676fae21b6aaa650a8","https://github.com/python/cpython/commit/e2a9dd97ef9571c710ac0afaa834c8879aebce78","https://github.com/python/cpython/commit/e4500d8a437ee5b988a5410cb9b59d177aa01370","https://github.com/python/cpython/commit/e4f63e65a93cf44c14274aa987e644b8c003625e","https://github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/24/5"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-24T18:07:53.662Z"}}],"cna":{"orgId":"28c92f92-d60d-412d-b760-e73465c3df22","shortName":"PSF","dateUpdated":"2026-10-25T00:39:26.520Z"}}},"related_cves":[{"value":"CVE-2026-115557","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:cde9c1fe-8101-4c33-906b-d22487b77bf0","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115557","advisory_id":"cde9c1fe-8101-4c33-906b-d22487b77bf0","event_types":["advisory"],"published_at":"2026-10-25T16:46:07.800219+00:00","technologies":["core-cve","cpython"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T14:15:14.283+00:00","detail_url":"/events/56689"}]}},{"id":52997,"cve_ids":["CVE-2026-114583"],"payload":{"kind":"advisory","title":"tar filter allows writing outside destination via empty-named symlink","summary":"tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() with filter=\"tar\" to write files outside the destination directory, subject to the permissions of the extracting process. This is the tarfile.tar_filter counterpart of CVE-2026-7774, which covered tarfile.data_filter.","evidence":"cve:CVE-2026-114583","products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-114583","aliases":["CVE-2026-114583"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6.9,"Automatable":"NOT_DEFINED","attackVector":"LOCAL","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/python/cpython","vendor":"Python Software Foundation","modules":["tarfile"],"product":"CPython","versions":[{"status":"affected","version":"0","lessThan":"3.16.0","versionType":"python"}],"defaultStatus":"unaffected"}],"modified":"2026-10-23T00:36:58.472Z","provider":"cve","references":["https://github.com/python/cpython/pull/160098","https://github.com/python/cpython/issues/160097","https://mail.python.org/archives/list/security-announce@python.org/thread/43JOWPRAV5DI3VZ4FUEUAZOHCATXXOCK/","https://github.com/python/cpython/commit/0901ad4ffb22605f12b705d1c1197f0a01f0ba0b","https://github.com/python/cpython/commit/c6ada40177436e4e2533a7b252082b5f0c043477","https://github.com/python/cpython/commit/e7e0b3523ad6ba8472873dda594cf4021a16f8b5"],"provider_metadata":{"cna":{"orgId":"28c92f92-d60d-412d-b760-e73465c3df22","shortName":"PSF","dateUpdated":"2026-10-23T00:36:58.472Z"}}},"related_cves":[{"value":"CVE-2026-114583","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:a68ad0a6-c52a-4587-83ec-5711b50e352b","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114583","advisory_id":"a68ad0a6-c52a-4587-83ec-5711b50e352b","event_types":["advisory"],"published_at":"2026-10-25T14:46:46.013581+00:00","technologies":["core-cve","cpython"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T20:57:36.019+00:00","detail_url":"/advisories/advisory%3Aa68ad0a6-c52a-4587-83ec-5711b50e352b","group":{"id":"advisory:a68ad0a6-c52a-4587-83ec-5711b50e352b","revision":1,"primary_event_id":52526,"change":"published","superseded_by":[],"changed":{"id":52526,"cve_ids":["CVE-2026-114583"],"payload":{"kind":"advisory","title":"tar filter allows writing outside destination via empty-named symlink","summary":"tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() with filter=\"tar\" to write files outside the destination directory, subject to the permissions of the extracting process. This is the tarfile.tar_filter counterpart of CVE-2026-7774, which covered tarfile.data_filter.","evidence":"cve:CVE-2026-114583","products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-114583","aliases":["CVE-2026-114583"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6.9,"Automatable":"NOT_DEFINED","attackVector":"LOCAL","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/python/cpython","vendor":"Python Software Foundation","modules":["tarfile"],"product":"CPython","versions":[{"status":"affected","version":"0","lessThan":"3.16.0","versionType":"python"}],"defaultStatus":"unaffected"}],"modified":"2026-10-23T00:36:58.472Z","provider":"cve","references":["https://github.com/python/cpython/pull/160098","https://github.com/python/cpython/issues/160097","https://mail.python.org/archives/list/security-announce@python.org/thread/43JOWPRAV5DI3VZ4FUEUAZOHCATXXOCK/","https://github.com/python/cpython/commit/0901ad4ffb22605f12b705d1c1197f0a01f0ba0b","https://github.com/python/cpython/commit/c6ada40177436e4e2533a7b252082b5f0c043477","https://github.com/python/cpython/commit/e7e0b3523ad6ba8472873dda594cf4021a16f8b5"],"provider_metadata":{"cna":{"orgId":"28c92f92-d60d-412d-b760-e73465c3df22","shortName":"PSF","dateUpdated":"2026-10-23T00:36:58.472Z"}}},"related_cves":[{"value":"CVE-2026-114583","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:a68ad0a6-c52a-4587-83ec-5711b50e352b","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114583","advisory_id":"a68ad0a6-c52a-4587-83ec-5711b50e352b","event_types":["advisory"],"published_at":"2026-10-25T14:46:46.013581+00:00","technologies":["core-cve","cpython"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T20:57:36.019+00:00","detail_url":"/events/52526"},"members":[{"id":52526,"cve_ids":["CVE-2026-114583"],"payload":{"kind":"advisory","title":"tar filter allows writing outside destination via empty-named symlink","summary":"tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() with filter=\"tar\" to write files outside the destination directory, subject to the permissions of the extracting process. This is the tarfile.tar_filter counterpart of CVE-2026-7774, which covered tarfile.data_filter.","evidence":"cve:CVE-2026-114583","products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-114583","aliases":["CVE-2026-114583"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6.9,"Automatable":"NOT_DEFINED","attackVector":"LOCAL","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/python/cpython","vendor":"Python Software Foundation","modules":["tarfile"],"product":"CPython","versions":[{"status":"affected","version":"0","lessThan":"3.16.0","versionType":"python"}],"defaultStatus":"unaffected"}],"modified":"2026-10-23T00:36:58.472Z","provider":"cve","references":["https://github.com/python/cpython/pull/160098","https://github.com/python/cpython/issues/160097","https://mail.python.org/archives/list/security-announce@python.org/thread/43JOWPRAV5DI3VZ4FUEUAZOHCATXXOCK/","https://github.com/python/cpython/commit/0901ad4ffb22605f12b705d1c1197f0a01f0ba0b","https://github.com/python/cpython/commit/c6ada40177436e4e2533a7b252082b5f0c043477","https://github.com/python/cpython/commit/e7e0b3523ad6ba8472873dda594cf4021a16f8b5"],"provider_metadata":{"cna":{"orgId":"28c92f92-d60d-412d-b760-e73465c3df22","shortName":"PSF","dateUpdated":"2026-10-23T00:36:58.472Z"}}},"related_cves":[{"value":"CVE-2026-114583","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:a68ad0a6-c52a-4587-83ec-5711b50e352b","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114583","advisory_id":"a68ad0a6-c52a-4587-83ec-5711b50e352b","event_types":["advisory"],"published_at":"2026-10-25T14:46:46.013581+00:00","technologies":["core-cve","cpython"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T20:57:36.019+00:00","detail_url":"/events/52526"}]}},{"id":50508,"cve_ids":["CVE-2026-87910"],"payload":{"kind":"advisory","title":"tarfile hardlink fallback ignores custom extraction filter rejection via None","summary":"When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None.","evidence":"cve:CVE-2026-87910","products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-87910","aliases":["CVE-2026-87910"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":5.7,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"ACTIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/python/cpython","vendor":"Python Software Foundation","modules":["tarfile"],"product":"CPython","versions":[{"status":"affected","version":"0","lessThan":"3.10.22","versionType":"python"},{"status":"affected","version":"3.11.0","lessThan":"3.11.17","versionType":"python"},{"status":"affected","version":"3.12.0","lessThan":"3.12.15","versionType":"python"},{"status":"affected","version":"3.13.0","lessThan":"3.13.16","versionType":"python"},{"status":"affected","version":"3.14.0","lessThan":"3.14.9","versionType":"python"},{"status":"affected","version":"3.15.0a1","lessThan":"3.15.0rc3","versionType":"python"}],"defaultStatus":"unaffected"}],"modified":"2026-10-22T00:31:28.666Z","provider":"cve","references":["https://mail.python.org/archives/list/security-announce@python.org/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/","https://github.com/python/cpython/pull/157266","https://github.com/python/cpython/issues/157265","https://github.com/python/cpython/commit/d9565e54b1fc6d63c5be9afd58114499128fa57b","https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2","https://github.com/python/cpython/commit/9c17bace90f88dfba6d0e2fe23c8e7ae35f83955","https://github.com/python/cpython/commit/764fd0af8d9e19d3684a58d2e58bf770f0605036","https://github.com/python/cpython/commit/2eb0c2f1dc71847731b6ab30aebefd058d482a7f","https://github.com/python/cpython/commit/c1f106d240c4ffcb3608ed0a20e8aba6c865f6d3","https://github.com/python/cpython/commit/3105a3498aaf681ce128cf5baf83c2e5574267c5","https://github.com/python/cpython/commit/a4919937a4e1e69a0d178909c6f20557eca5d1d0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-87910","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-11T19:23:39.973519Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-11T19:23:49.726Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/09/11/8"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-09-11T21:07:14.642Z"}}],"cna":{"orgId":"28c92f92-d60d-412d-b760-e73465c3df22","shortName":"PSF","dateUpdated":"2026-10-22T00:31:28.666Z"}}},"related_cves":[{"value":"CVE-2026-87910","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:b20337ae-216d-4208-bc26-6936bf52b712","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-87910","advisory_id":"b20337ae-216d-4208-bc26-6936bf52b712","event_types":["advisory"],"published_at":"2026-10-25T13:59:45.88222+00:00","technologies":["core-cve","cpython"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-11T17:27:04.339+00:00","detail_url":"/advisories/advisory%3Ab20337ae-216d-4208-bc26-6936bf52b712","group":{"id":"advisory:b20337ae-216d-4208-bc26-6936bf52b712","revision":1,"primary_event_id":50036,"change":"published","superseded_by":[],"changed":{"id":50036,"cve_ids":["CVE-2026-87910"],"payload":{"kind":"advisory","title":"tarfile hardlink fallback ignores custom extraction filter rejection via None","summary":"When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None.","evidence":"cve:CVE-2026-87910","products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-87910","aliases":["CVE-2026-87910"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":5.7,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"ACTIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/python/cpython","vendor":"Python Software Foundation","modules":["tarfile"],"product":"CPython","versions":[{"status":"affected","version":"0","lessThan":"3.10.22","versionType":"python"},{"status":"affected","version":"3.11.0","lessThan":"3.11.17","versionType":"python"},{"status":"affected","version":"3.12.0","lessThan":"3.12.15","versionType":"python"},{"status":"affected","version":"3.13.0","lessThan":"3.13.16","versionType":"python"},{"status":"affected","version":"3.14.0","lessThan":"3.14.9","versionType":"python"},{"status":"affected","version":"3.15.0a1","lessThan":"3.15.0rc3","versionType":"python"}],"defaultStatus":"unaffected"}],"modified":"2026-10-22T00:31:28.666Z","provider":"cve","references":["https://mail.python.org/archives/list/security-announce@python.org/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/","https://github.com/python/cpython/pull/157266","https://github.com/python/cpython/issues/157265","https://github.com/python/cpython/commit/d9565e54b1fc6d63c5be9afd58114499128fa57b","https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2","https://github.com/python/cpython/commit/9c17bace90f88dfba6d0e2fe23c8e7ae35f83955","https://github.com/python/cpython/commit/764fd0af8d9e19d3684a58d2e58bf770f0605036","https://github.com/python/cpython/commit/2eb0c2f1dc71847731b6ab30aebefd058d482a7f","https://github.com/python/cpython/commit/c1f106d240c4ffcb3608ed0a20e8aba6c865f6d3","https://github.com/python/cpython/commit/3105a3498aaf681ce128cf5baf83c2e5574267c5","https://github.com/python/cpython/commit/a4919937a4e1e69a0d178909c6f20557eca5d1d0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-87910","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-11T19:23:39.973519Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-11T19:23:49.726Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/09/11/8"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-09-11T21:07:14.642Z"}}],"cna":{"orgId":"28c92f92-d60d-412d-b760-e73465c3df22","shortName":"PSF","dateUpdated":"2026-10-22T00:31:28.666Z"}}},"related_cves":[{"value":"CVE-2026-87910","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:b20337ae-216d-4208-bc26-6936bf52b712","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-87910","advisory_id":"b20337ae-216d-4208-bc26-6936bf52b712","event_types":["advisory"],"published_at":"2026-10-25T13:59:45.88222+00:00","technologies":["core-cve","cpython"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-11T17:27:04.339+00:00","detail_url":"/events/50036"},"members":[{"id":50036,"cve_ids":["CVE-2026-87910"],"payload":{"kind":"advisory","title":"tarfile hardlink fallback ignores custom extraction filter rejection via None","summary":"When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None.","evidence":"cve:CVE-2026-87910","products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-87910","aliases":["CVE-2026-87910"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":5.7,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"ACTIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/python/cpython","vendor":"Python Software Foundation","modules":["tarfile"],"product":"CPython","versions":[{"status":"affected","version":"0","lessThan":"3.10.22","versionType":"python"},{"status":"affected","version":"3.11.0","lessThan":"3.11.17","versionType":"python"},{"status":"affected","version":"3.12.0","lessThan":"3.12.15","versionType":"python"},{"status":"affected","version":"3.13.0","lessThan":"3.13.16","versionType":"python"},{"status":"affected","version":"3.14.0","lessThan":"3.14.9","versionType":"python"},{"status":"affected","version":"3.15.0a1","lessThan":"3.15.0rc3","versionType":"python"}],"defaultStatus":"unaffected"}],"modified":"2026-10-22T00:31:28.666Z","provider":"cve","references":["https://mail.python.org/archives/list/security-announce@python.org/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/","https://github.com/python/cpython/pull/157266","https://github.com/python/cpython/issues/157265","https://github.com/python/cpython/commit/d9565e54b1fc6d63c5be9afd58114499128fa57b","https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2","https://github.com/python/cpython/commit/9c17bace90f88dfba6d0e2fe23c8e7ae35f83955","https://github.com/python/cpython/commit/764fd0af8d9e19d3684a58d2e58bf770f0605036","https://github.com/python/cpython/commit/2eb0c2f1dc71847731b6ab30aebefd058d482a7f","https://github.com/python/cpython/commit/c1f106d240c4ffcb3608ed0a20e8aba6c865f6d3","https://github.com/python/cpython/commit/3105a3498aaf681ce128cf5baf83c2e5574267c5","https://github.com/python/cpython/commit/a4919937a4e1e69a0d178909c6f20557eca5d1d0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-87910","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-11T19:23:39.973519Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-11T19:23:49.726Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/09/11/8"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-09-11T21:07:14.642Z"}}],"cna":{"orgId":"28c92f92-d60d-412d-b760-e73465c3df22","shortName":"PSF","dateUpdated":"2026-10-22T00:31:28.666Z"}}},"related_cves":[{"value":"CVE-2026-87910","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:b20337ae-216d-4208-bc26-6936bf52b712","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-87910","advisory_id":"b20337ae-216d-4208-bc26-6936bf52b712","event_types":["advisory"],"published_at":"2026-10-25T13:59:45.88222+00:00","technologies":["core-cve","cpython"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-11T17:27:04.339+00:00","detail_url":"/events/50036"}]}},{"id":50507,"cve_ids":["CVE-2026-12345"],"payload":{"kind":"advisory","title":"Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory","summary":"The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoids_symlink_attacks is false, remain affected, and file flags may still be reset outside of the tree on all platforms.","evidence":"cve:CVE-2026-12345","products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-12345","aliases":["CVE-2026-12345"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":5.9,"Automatable":"NOT_DEFINED","attackVector":"LOCAL","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/python/cpython","vendor":"Python Software Foundation","modules":["tempfile"],"product":"CPython","versions":[{"status":"affected","version":"0","lessThan":"3.12.15","versionType":"python"},{"status":"affected","version":"3.14.0","lessThan":"3.14.9","versionType":"python"},{"status":"affected","version":"3.15.0a1","lessThan":"3.15.0rc3","versionType":"python"}],"defaultStatus":"unaffected"}],"modified":"2026-10-22T00:37:01.025Z","provider":"cve","references":["https://github.com/python/cpython/pull/157580","https://github.com/python/cpython/issues/157579","https://github.com/python/cpython/commit/5c20517a4fc56683efe63a7751020db9573f538d","https://github.com/python/cpython/commit/458e7134a5af7f86aee9d21b51cf499b41aa4420","https://github.com/python/cpython/commit/e1f3590f155c6d66007e958c98c9d69316551993","https://github.com/python/cpython/commit/06ef3d43fdaf4da97af12fa694b4886092c4b970","https://github.com/python/cpython/commit/58ed0259cae509a19138795df302fe60b544dc74"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-12345","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-29T18:38:00.590353Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-59","description":"CWE-59 Improper Link Resolution Before File Access ('Link Following')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T18:38:55.324Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/09/29/40"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-09-29T21:07:55.567Z"}}],"cna":{"orgId":"28c92f92-d60d-412d-b760-e73465c3df22","shortName":"PSF","dateUpdated":"2026-10-22T00:37:01.025Z"}}},"related_cves":[{"value":"CVE-2026-12345","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:e0fc8059-5673-4d43-b197-ae0c9686ed00","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-12345","advisory_id":"e0fc8059-5673-4d43-b197-ae0c9686ed00","event_types":["advisory"],"published_at":"2026-10-25T13:59:45.246439+00:00","technologies":["core-cve","cpython"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T17:46:01.811+00:00","detail_url":"/advisories/advisory%3Ae0fc8059-5673-4d43-b197-ae0c9686ed00","group":{"id":"advisory:e0fc8059-5673-4d43-b197-ae0c9686ed00","revision":1,"primary_event_id":50035,"change":"published","superseded_by":[],"changed":{"id":50035,"cve_ids":["CVE-2026-12345"],"payload":{"kind":"advisory","title":"Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory","summary":"The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoids_symlink_attacks is false, remain affected, and file flags may still be reset outside of the tree on all platforms.","evidence":"cve:CVE-2026-12345","products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-12345","aliases":["CVE-2026-12345"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":5.9,"Automatable":"NOT_DEFINED","attackVector":"LOCAL","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/python/cpython","vendor":"Python Software Foundation","modules":["tempfile"],"product":"CPython","versions":[{"status":"affected","version":"0","lessThan":"3.12.15","versionType":"python"},{"status":"affected","version":"3.14.0","lessThan":"3.14.9","versionType":"python"},{"status":"affected","version":"3.15.0a1","lessThan":"3.15.0rc3","versionType":"python"}],"defaultStatus":"unaffected"}],"modified":"2026-10-22T00:37:01.025Z","provider":"cve","references":["https://github.com/python/cpython/pull/157580","https://github.com/python/cpython/issues/157579","https://github.com/python/cpython/commit/5c20517a4fc56683efe63a7751020db9573f538d","https://github.com/python/cpython/commit/458e7134a5af7f86aee9d21b51cf499b41aa4420","https://github.com/python/cpython/commit/e1f3590f155c6d66007e958c98c9d69316551993","https://github.com/python/cpython/commit/06ef3d43fdaf4da97af12fa694b4886092c4b970","https://github.com/python/cpython/commit/58ed0259cae509a19138795df302fe60b544dc74"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-12345","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-29T18:38:00.590353Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-59","description":"CWE-59 Improper Link Resolution Before File Access ('Link Following')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T18:38:55.324Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/09/29/40"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-09-29T21:07:55.567Z"}}],"cna":{"orgId":"28c92f92-d60d-412d-b760-e73465c3df22","shortName":"PSF","dateUpdated":"2026-10-22T00:37:01.025Z"}}},"related_cves":[{"value":"CVE-2026-12345","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:e0fc8059-5673-4d43-b197-ae0c9686ed00","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-12345","advisory_id":"e0fc8059-5673-4d43-b197-ae0c9686ed00","event_types":["advisory"],"published_at":"2026-10-25T13:59:45.246439+00:00","technologies":["core-cve","cpython"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T17:46:01.811+00:00","detail_url":"/events/50035"},"members":[{"id":50035,"cve_ids":["CVE-2026-12345"],"payload":{"kind":"advisory","title":"Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory","summary":"The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoids_symlink_attacks is false, remain affected, and file flags may still be reset outside of the tree on all platforms.","evidence":"cve:CVE-2026-12345","products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-12345","aliases":["CVE-2026-12345"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":5.9,"Automatable":"NOT_DEFINED","attackVector":"LOCAL","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/python/cpython","vendor":"Python Software Foundation","modules":["tempfile"],"product":"CPython","versions":[{"status":"affected","version":"0","lessThan":"3.12.15","versionType":"python"},{"status":"affected","version":"3.14.0","lessThan":"3.14.9","versionType":"python"},{"status":"affected","version":"3.15.0a1","lessThan":"3.15.0rc3","versionType":"python"}],"defaultStatus":"unaffected"}],"modified":"2026-10-22T00:37:01.025Z","provider":"cve","references":["https://github.com/python/cpython/pull/157580","https://github.com/python/cpython/issues/157579","https://github.com/python/cpython/commit/5c20517a4fc56683efe63a7751020db9573f538d","https://github.com/python/cpython/commit/458e7134a5af7f86aee9d21b51cf499b41aa4420","https://github.com/python/cpython/commit/e1f3590f155c6d66007e958c98c9d69316551993","https://github.com/python/cpython/commit/06ef3d43fdaf4da97af12fa694b4886092c4b970","https://github.com/python/cpython/commit/58ed0259cae509a19138795df302fe60b544dc74"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-12345","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-29T18:38:00.590353Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-59","description":"CWE-59 Improper Link Resolution Before File Access ('Link Following')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T18:38:55.324Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/09/29/40"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-09-29T21:07:55.567Z"}}],"cna":{"orgId":"28c92f92-d60d-412d-b760-e73465c3df22","shortName":"PSF","dateUpdated":"2026-10-22T00:37:01.025Z"}}},"related_cves":[{"value":"CVE-2026-12345","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:e0fc8059-5673-4d43-b197-ae0c9686ed00","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-12345","advisory_id":"e0fc8059-5673-4d43-b197-ae0c9686ed00","event_types":["advisory"],"published_at":"2026-10-25T13:59:45.246439+00:00","technologies":["core-cve","cpython"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T17:46:01.811+00:00","detail_url":"/events/50035"}]}},{"id":50503,"cve_ids":["CVE-2024-3220"],"payload":{"kind":"advisory","title":"Default mimetype known files writeable on Windows","summary":"There is a defect in the CPython standard library module “mimetypes” where on Windows the default list of known file locations are writable meaning other users can create invalid files to cause MemoryError to be raised on Python runtime startup or have file extensions be interpreted as the incorrect file type. This defect is caused by the default locations of Linux and macOS platforms (such as “/etc/mime.types”) also being used on Windows, where they are user-writable locations (“C:\\etc\\mime.types”). To work-around this issue a user can call mimetypes.init() with an empty list (“[]”) on Windows platforms to avoid using the default list of known file locations.","evidence":"cve:CVE-2024-3220","products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2024-3220","aliases":["CVE-2024-3220"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":2.3,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"LOW","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/python/cpython","vendor":"Python Software Foundation","modules":["mimetypes"],"product":"CPython","versions":[{"status":"affected","version":"0","lessThan":"3.14.9","versionType":"python"},{"status":"affected","version":"3.15.0","lessThan":"3.15.1","versionType":"python"},{"status":"affected","version":"3.16.0a1","lessThan":"3.16.0","versionType":"python"}],"defaultStatus":"unaffected"}],"modified":"2026-10-22T00:43:56.100Z","provider":"cve","references":["https://mail.python.org/archives/list/security-announce@python.org/thread/CDXW34ND2LSAOYAR5N6UNONP4ZBX4D6R/","https://github.com/python/cpython/issues/159428","https://github.com/python/cpython/commit/04a29bf8f9ff8526cd96cb7368400173303a390a","https://github.com/python/cpython/commit/5550519259656cbb8eeac09e3dbc0d5c248a4dea","https://github.com/python/cpython/commit/76f4555c4ff10f5dda58d6528c17787df41e256c"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-3220","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2025-02-14T16:46:00.511698Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-02-14T16:46:05.095Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2025/02/14/8"},{"url":"https://security.netapp.com/advisory/ntap-20250314-0001/"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-03-14T10:03:04.669Z"}}],"cna":{"orgId":"28c92f92-d60d-412d-b760-e73465c3df22","shortName":"PSF","dateUpdated":"2026-10-22T00:43:56.100Z"}}},"related_cves":[{"value":"CVE-2024-3220","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:8e0c59bf-72ec-4b88-abd2-99f323d178cc","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-3220","advisory_id":"8e0c59bf-72ec-4b88-abd2-99f323d178cc","event_types":["advisory"],"published_at":"2026-10-25T13:59:42.681507+00:00","technologies":["core-cve","cpython"],"context_update":false,"extraction_method":"structured","source_published_at":"2025-02-14T16:18:00.918+00:00","detail_url":"/advisories/advisory%3A8e0c59bf-72ec-4b88-abd2-99f323d178cc","group":{"id":"advisory:8e0c59bf-72ec-4b88-abd2-99f323d178cc","revision":1,"primary_event_id":50031,"change":"published","superseded_by":[],"changed":{"id":50031,"cve_ids":["CVE-2024-3220"],"payload":{"kind":"advisory","title":"Default mimetype known files writeable on Windows","summary":"There is a defect in the CPython standard library module “mimetypes” where on Windows the default list of known file locations are writable meaning other users can create invalid files to cause MemoryError to be raised on Python runtime startup or have file extensions be interpreted as the incorrect file type. This defect is caused by the default locations of Linux and macOS platforms (such as “/etc/mime.types”) also being used on Windows, where they are user-writable locations (“C:\\etc\\mime.types”). To work-around this issue a user can call mimetypes.init() with an empty list (“[]”) on Windows platforms to avoid using the default list of known file locations.","evidence":"cve:CVE-2024-3220","products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2024-3220","aliases":["CVE-2024-3220"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":2.3,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"LOW","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/python/cpython","vendor":"Python Software Foundation","modules":["mimetypes"],"product":"CPython","versions":[{"status":"affected","version":"0","lessThan":"3.14.9","versionType":"python"},{"status":"affected","version":"3.15.0","lessThan":"3.15.1","versionType":"python"},{"status":"affected","version":"3.16.0a1","lessThan":"3.16.0","versionType":"python"}],"defaultStatus":"unaffected"}],"modified":"2026-10-22T00:43:56.100Z","provider":"cve","references":["https://mail.python.org/archives/list/security-announce@python.org/thread/CDXW34ND2LSAOYAR5N6UNONP4ZBX4D6R/","https://github.com/python/cpython/issues/159428","https://github.com/python/cpython/commit/04a29bf8f9ff8526cd96cb7368400173303a390a","https://github.com/python/cpython/commit/5550519259656cbb8eeac09e3dbc0d5c248a4dea","https://github.com/python/cpython/commit/76f4555c4ff10f5dda58d6528c17787df41e256c"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-3220","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2025-02-14T16:46:00.511698Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-02-14T16:46:05.095Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2025/02/14/8"},{"url":"https://security.netapp.com/advisory/ntap-20250314-0001/"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-03-14T10:03:04.669Z"}}],"cna":{"orgId":"28c92f92-d60d-412d-b760-e73465c3df22","shortName":"PSF","dateUpdated":"2026-10-22T00:43:56.100Z"}}},"related_cves":[{"value":"CVE-2024-3220","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:8e0c59bf-72ec-4b88-abd2-99f323d178cc","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-3220","advisory_id":"8e0c59bf-72ec-4b88-abd2-99f323d178cc","event_types":["advisory"],"published_at":"2026-10-25T13:59:42.681507+00:00","technologies":["core-cve","cpython"],"context_update":false,"extraction_method":"structured","source_published_at":"2025-02-14T16:18:00.918+00:00","detail_url":"/events/50031"},"members":[{"id":50031,"cve_ids":["CVE-2024-3220"],"payload":{"kind":"advisory","title":"Default mimetype known files writeable on Windows","summary":"There is a defect in the CPython standard library module “mimetypes” where on Windows the default list of known file locations are writable meaning other users can create invalid files to cause MemoryError to be raised on Python runtime startup or have file extensions be interpreted as the incorrect file type. This defect is caused by the default locations of Linux and macOS platforms (such as “/etc/mime.types”) also being used on Windows, where they are user-writable locations (“C:\\etc\\mime.types”). To work-around this issue a user can call mimetypes.init() with an empty list (“[]”) on Windows platforms to avoid using the default list of known file locations.","evidence":"cve:CVE-2024-3220","products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2024-3220","aliases":["CVE-2024-3220"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":2.3,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"LOW","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/python/cpython","vendor":"Python Software Foundation","modules":["mimetypes"],"product":"CPython","versions":[{"status":"affected","version":"0","lessThan":"3.14.9","versionType":"python"},{"status":"affected","version":"3.15.0","lessThan":"3.15.1","versionType":"python"},{"status":"affected","version":"3.16.0a1","lessThan":"3.16.0","versionType":"python"}],"defaultStatus":"unaffected"}],"modified":"2026-10-22T00:43:56.100Z","provider":"cve","references":["https://mail.python.org/archives/list/security-announce@python.org/thread/CDXW34ND2LSAOYAR5N6UNONP4ZBX4D6R/","https://github.com/python/cpython/issues/159428","https://github.com/python/cpython/commit/04a29bf8f9ff8526cd96cb7368400173303a390a","https://github.com/python/cpython/commit/5550519259656cbb8eeac09e3dbc0d5c248a4dea","https://github.com/python/cpython/commit/76f4555c4ff10f5dda58d6528c17787df41e256c"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-3220","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2025-02-14T16:46:00.511698Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-02-14T16:46:05.095Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2025/02/14/8"},{"url":"https://security.netapp.com/advisory/ntap-20250314-0001/"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-03-14T10:03:04.669Z"}}],"cna":{"orgId":"28c92f92-d60d-412d-b760-e73465c3df22","shortName":"PSF","dateUpdated":"2026-10-22T00:43:56.100Z"}}},"related_cves":[{"value":"CVE-2024-3220","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:8e0c59bf-72ec-4b88-abd2-99f323d178cc","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-3220","advisory_id":"8e0c59bf-72ec-4b88-abd2-99f323d178cc","event_types":["advisory"],"published_at":"2026-10-25T13:59:42.681507+00:00","technologies":["core-cve","cpython"],"context_update":false,"extraction_method":"structured","source_published_at":"2025-02-14T16:18:00.918+00:00","detail_url":"/events/50031"}]}},{"id":33204,"cve_ids":["CVE-2026-19553"],"payload":{"kind":"advisory","title":"SSLContext.wrap_bio() missing validation of server_hostname parameter","summary":"ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a missing parameter check in SSLObject, if the server_hostname argument isn't supplied then hostname verification would be silently skipped. This defect could lead to programs where certificate hostname verification *appeared* to be succeeding with SSLContext.check_hostname = True and no ValueError being raised due to misconfiguration. If the program passes a server_hostname value that isn't an empty string or None to any of these APIs then certificate hostname verification proceeds as expected and the program is not affected by this vulnerability. Mitigating this vulnerability doesn't require updating Python or applying the patch. To mitigate, pass a valid non-None and non-empty server_hostname value to SSLContext.wrap_bio(), asyncio.create_connection(), or asyncio.loop.start_tls() and certificate hostname verification will proceed as expected. Upgrading to the latest version of Python or applying the patch only changes the behavior from silently skipping hostname verification to raising a ValueError, similar to SSLContext.wrap_socket(), when server_hostname isn't supplied.","evidence":"cve:CVE-2026-19553","products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-19553","aliases":["CVE-2026-19553"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":7.6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/python/cpython","vendor":"Python Software Foundation","modules":["ssl"],"product":"CPython","versions":[{"status":"affected","version":"0","lessThan":"3.10.22","versionType":"python"},{"status":"affected","version":"3.11.0","lessThan":"3.11.17","versionType":"python"},{"status":"affected","version":"3.12.0","lessThan":"3.12.15","versionType":"python"},{"status":"affected","version":"3.13.0","lessThan":"3.13.16","versionType":"python"},{"status":"affected","version":"3.14.0","lessThan":"3.14.8","versionType":"python"},{"status":"affected","version":"3.15.0a1","lessThan":"3.15.0rc3","versionType":"python"}],"defaultStatus":"unaffected"}],"modified":"2026-10-16T18:33:12.475Z","provider":"cve","references":["https://github.com/python/cpython/pull/158503","https://github.com/python/cpython/issues/156793","https://mail.python.org/archives/list/security-announce@python.org/thread/QNZRG3YOAMTHDCMVCICXGY6YEFPY2VDL/","https://github.com/python/cpython/commit/1697ea386c707142555d98a1263176bbbc014a96","https://github.com/python/cpython/commit/641390146a16a38e6701923f4ee4f1940ae77082","https://github.com/python/cpython/commit/966bf426d0b6c31c1b0a255ff14a17143a466ced","https://github.com/python/cpython/commit/f4e43ba525187282f2011da0e6ffc0d2b08d8062","https://github.com/python/cpython/commit/869069d52ce0efab2f8c38197e92cdaaa312f1ed","https://github.com/python/cpython/commit/5867d4e4ae6d1062352baf6b497a4026e8578ccf","https://github.com/python/cpython/commit/bdebbf9b366ec91e9cd9daa0b3510c9e84b60b80"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/09/30/16"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-09-30T18:09:40.939Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-19553","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T18:33:08.291056Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-16T18:33:12.475Z"}}],"cna":{"orgId":"28c92f92-d60d-412d-b760-e73465c3df22","shortName":"PSF","dateUpdated":"2026-10-03T00:36:35.156Z"}}},"related_cves":[{"value":"CVE-2026-19553","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:17634456-be9a-4af4-860d-e312e7eb05de","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-19553","advisory_id":"17634456-be9a-4af4-860d-e312e7eb05de","event_types":["advisory"],"published_at":"2026-10-25T08:57:46.510868+00:00","technologies":["core-cve","cpython"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T16:17:39.368+00:00","detail_url":"/advisories/advisory%3A17634456-be9a-4af4-860d-e312e7eb05de","group":{"id":"advisory:17634456-be9a-4af4-860d-e312e7eb05de","revision":1,"primary_event_id":32928,"change":"published","superseded_by":[],"changed":{"id":32928,"cve_ids":["CVE-2026-19553"],"payload":{"kind":"advisory","title":"SSLContext.wrap_bio() missing validation of server_hostname parameter","summary":"ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a missing parameter check in SSLObject, if the server_hostname argument isn't supplied then hostname verification would be silently skipped. This defect could lead to programs where certificate hostname verification *appeared* to be succeeding with SSLContext.check_hostname = True and no ValueError being raised due to misconfiguration. If the program passes a server_hostname value that isn't an empty string or None to any of these APIs then certificate hostname verification proceeds as expected and the program is not affected by this vulnerability. Mitigating this vulnerability doesn't require updating Python or applying the patch. To mitigate, pass a valid non-None and non-empty server_hostname value to SSLContext.wrap_bio(), asyncio.create_connection(), or asyncio.loop.start_tls() and certificate hostname verification will proceed as expected. Upgrading to the latest version of Python or applying the patch only changes the behavior from silently skipping hostname verification to raising a ValueError, similar to SSLContext.wrap_socket(), when server_hostname isn't supplied.","evidence":"cve:CVE-2026-19553","products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-19553","aliases":["CVE-2026-19553"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":7.6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/python/cpython","vendor":"Python Software Foundation","modules":["ssl"],"product":"CPython","versions":[{"status":"affected","version":"0","lessThan":"3.10.22","versionType":"python"},{"status":"affected","version":"3.11.0","lessThan":"3.11.17","versionType":"python"},{"status":"affected","version":"3.12.0","lessThan":"3.12.15","versionType":"python"},{"status":"affected","version":"3.13.0","lessThan":"3.13.16","versionType":"python"},{"status":"affected","version":"3.14.0","lessThan":"3.14.8","versionType":"python"},{"status":"affected","version":"3.15.0a1","lessThan":"3.15.0rc3","versionType":"python"}],"defaultStatus":"unaffected"}],"modified":"2026-10-16T18:33:12.475Z","provider":"cve","references":["https://github.com/python/cpython/pull/158503","https://github.com/python/cpython/issues/156793","https://mail.python.org/archives/list/security-announce@python.org/thread/QNZRG3YOAMTHDCMVCICXGY6YEFPY2VDL/","https://github.com/python/cpython/commit/1697ea386c707142555d98a1263176bbbc014a96","https://github.com/python/cpython/commit/641390146a16a38e6701923f4ee4f1940ae77082","https://github.com/python/cpython/commit/966bf426d0b6c31c1b0a255ff14a17143a466ced","https://github.com/python/cpython/commit/f4e43ba525187282f2011da0e6ffc0d2b08d8062","https://github.com/python/cpython/commit/869069d52ce0efab2f8c38197e92cdaaa312f1ed","https://github.com/python/cpython/commit/5867d4e4ae6d1062352baf6b497a4026e8578ccf","https://github.com/python/cpython/commit/bdebbf9b366ec91e9cd9daa0b3510c9e84b60b80"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/09/30/16"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-09-30T18:09:40.939Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-19553","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T18:33:08.291056Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-16T18:33:12.475Z"}}],"cna":{"orgId":"28c92f92-d60d-412d-b760-e73465c3df22","shortName":"PSF","dateUpdated":"2026-10-03T00:36:35.156Z"}}},"related_cves":[{"value":"CVE-2026-19553","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:17634456-be9a-4af4-860d-e312e7eb05de","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-19553","advisory_id":"17634456-be9a-4af4-860d-e312e7eb05de","event_types":["advisory"],"published_at":"2026-10-25T08:57:46.510868+00:00","technologies":["core-cve","cpython"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T16:17:39.368+00:00","detail_url":"/events/32928"},"members":[{"id":32928,"cve_ids":["CVE-2026-19553"],"payload":{"kind":"advisory","title":"SSLContext.wrap_bio() missing validation of server_hostname parameter","summary":"ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a missing parameter check in SSLObject, if the server_hostname argument isn't supplied then hostname verification would be silently skipped. This defect could lead to programs where certificate hostname verification *appeared* to be succeeding with SSLContext.check_hostname = True and no ValueError being raised due to misconfiguration. If the program passes a server_hostname value that isn't an empty string or None to any of these APIs then certificate hostname verification proceeds as expected and the program is not affected by this vulnerability. Mitigating this vulnerability doesn't require updating Python or applying the patch. To mitigate, pass a valid non-None and non-empty server_hostname value to SSLContext.wrap_bio(), asyncio.create_connection(), or asyncio.loop.start_tls() and certificate hostname verification will proceed as expected. Upgrading to the latest version of Python or applying the patch only changes the behavior from silently skipping hostname verification to raising a ValueError, similar to SSLContext.wrap_socket(), when server_hostname isn't supplied.","evidence":"cve:CVE-2026-19553","products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-19553","aliases":["CVE-2026-19553"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":7.6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/python/cpython","vendor":"Python Software Foundation","modules":["ssl"],"product":"CPython","versions":[{"status":"affected","version":"0","lessThan":"3.10.22","versionType":"python"},{"status":"affected","version":"3.11.0","lessThan":"3.11.17","versionType":"python"},{"status":"affected","version":"3.12.0","lessThan":"3.12.15","versionType":"python"},{"status":"affected","version":"3.13.0","lessThan":"3.13.16","versionType":"python"},{"status":"affected","version":"3.14.0","lessThan":"3.14.8","versionType":"python"},{"status":"affected","version":"3.15.0a1","lessThan":"3.15.0rc3","versionType":"python"}],"defaultStatus":"unaffected"}],"modified":"2026-10-16T18:33:12.475Z","provider":"cve","references":["https://github.com/python/cpython/pull/158503","https://github.com/python/cpython/issues/156793","https://mail.python.org/archives/list/security-announce@python.org/thread/QNZRG3YOAMTHDCMVCICXGY6YEFPY2VDL/","https://github.com/python/cpython/commit/1697ea386c707142555d98a1263176bbbc014a96","https://github.com/python/cpython/commit/641390146a16a38e6701923f4ee4f1940ae77082","https://github.com/python/cpython/commit/966bf426d0b6c31c1b0a255ff14a17143a466ced","https://github.com/python/cpython/commit/f4e43ba525187282f2011da0e6ffc0d2b08d8062","https://github.com/python/cpython/commit/869069d52ce0efab2f8c38197e92cdaaa312f1ed","https://github.com/python/cpython/commit/5867d4e4ae6d1062352baf6b497a4026e8578ccf","https://github.com/python/cpython/commit/bdebbf9b366ec91e9cd9daa0b3510c9e84b60b80"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/09/30/16"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-09-30T18:09:40.939Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-19553","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T18:33:08.291056Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-16T18:33:12.475Z"}}],"cna":{"orgId":"28c92f92-d60d-412d-b760-e73465c3df22","shortName":"PSF","dateUpdated":"2026-10-03T00:36:35.156Z"}}},"related_cves":[{"value":"CVE-2026-19553","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:17634456-be9a-4af4-860d-e312e7eb05de","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-19553","advisory_id":"17634456-be9a-4af4-860d-e312e7eb05de","event_types":["advisory"],"published_at":"2026-10-25T08:57:46.510868+00:00","technologies":["core-cve","cpython"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T16:17:39.368+00:00","detail_url":"/events/32928"}]}},{"id":30124,"cve_ids":["CVE-2018-1061"],"payload":{"kind":"advisory","title":"CVE-2018-1061","summary":"python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK method. An attacker could use this flaw to cause denial of service.","evidence":"cve:CVE-2018-1061","products":[{"name":{"value":"python","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2018-1061","aliases":["CVE-2018-1061"],"metrics":[{"cvssV3_0":{"scope":"UNCHANGED","version":"3.0","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"[UNKNOWN]","product":"python","versions":[{"status":"affected","version":"python 2.7.15"},{"status":"affected","version":"python 3.4.9"},{"status":"affected","version":"python 3.5.6"},{"status":"affected","version":"python 3.7.0"}]}],"modified":"2026-10-15T17:20:16.677Z","provider":"cve","references":["https://www.debian.org/security/2018/dsa-4306","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1061","https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html","https://bugs.python.org/issue32981","https://usn.ubuntu.com/3817-2/","https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-release-candidate-1","https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-6-release-candidate-1","https://access.redhat.com/errata/RHSA-2018:3505","https://access.redhat.com/errata/RHSA-2018:3041","https://www.debian.org/security/2018/dsa-4307","https://usn.ubuntu.com/3817-1/","https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2019:1260","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03951en_us","https://access.redhat.com/errata/RHSA-2019:3725"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.debian.org/security/2018/dsa-4306","name":"DSA-4306","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1061","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.securitytracker.com/id/1042001","name":"1042001","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html","name":"[debian-lts-announce] 20180926 [SECURITY] [DLA 1520-1] python3.4 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://bugs.python.org/issue32981","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://usn.ubuntu.com/3817-2/","name":"USN-3817-2","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-release-candidate-1","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-6-release-candidate-1","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3505","name":"RHSA-2018:3505","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3041","name":"RHSA-2018:3041","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://www.debian.org/security/2018/dsa-4307","name":"DSA-4307","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://usn.ubuntu.com/3817-1/","name":"USN-3817-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html","name":"[debian-lts-announce] 20180925 [SECURITY] [DLA 1519-1] python2.7 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/","name":"FEDORA-2019-6e1938a3c5","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/","name":"FEDORA-2019-cf725dd20b","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/","name":"FEDORA-2019-51f1e08207","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://access.redhat.com/errata/RHBA-2019:0327","name":"RHBA-2019:0327","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1260","name":"RHSA-2019:1260","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03951en_us","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3725","name":"RHSA-2019:3725","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","name":"openSUSE-SU-2020:0086","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-05T03:51:48.415Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2018-1061","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T17:20:05.235311Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T17:20:16.677Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2020-01-21T21:06:16.000Z"}}},"related_cves":[{"value":"CVE-2018-1061","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ecfeb222-b3f9-4ad3-b015-afe48fd89cf2","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2018-1061","advisory_id":"ecfeb222-b3f9-4ad3-b015-afe48fd89cf2","event_types":["advisory"],"published_at":"2026-10-25T08:06:27.983447+00:00","technologies":["core-cve","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2018-06-19T12:00:00+00:00","detail_url":"/advisories/advisory%3Aecfeb222-b3f9-4ad3-b015-afe48fd89cf2","group":{"id":"advisory:ecfeb222-b3f9-4ad3-b015-afe48fd89cf2","revision":1,"primary_event_id":29881,"change":"published","superseded_by":[],"changed":{"id":29881,"cve_ids":["CVE-2018-1061"],"payload":{"kind":"advisory","title":"CVE-2018-1061","summary":"python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK method. An attacker could use this flaw to cause denial of service.","evidence":"cve:CVE-2018-1061","products":[{"name":{"value":"python","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2018-1061","aliases":["CVE-2018-1061"],"metrics":[{"cvssV3_0":{"scope":"UNCHANGED","version":"3.0","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"[UNKNOWN]","product":"python","versions":[{"status":"affected","version":"python 2.7.15"},{"status":"affected","version":"python 3.4.9"},{"status":"affected","version":"python 3.5.6"},{"status":"affected","version":"python 3.7.0"}]}],"modified":"2026-10-15T17:20:16.677Z","provider":"cve","references":["https://www.debian.org/security/2018/dsa-4306","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1061","https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html","https://bugs.python.org/issue32981","https://usn.ubuntu.com/3817-2/","https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-release-candidate-1","https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-6-release-candidate-1","https://access.redhat.com/errata/RHSA-2018:3505","https://access.redhat.com/errata/RHSA-2018:3041","https://www.debian.org/security/2018/dsa-4307","https://usn.ubuntu.com/3817-1/","https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2019:1260","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03951en_us","https://access.redhat.com/errata/RHSA-2019:3725"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.debian.org/security/2018/dsa-4306","name":"DSA-4306","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1061","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.securitytracker.com/id/1042001","name":"1042001","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html","name":"[debian-lts-announce] 20180926 [SECURITY] [DLA 1520-1] python3.4 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://bugs.python.org/issue32981","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://usn.ubuntu.com/3817-2/","name":"USN-3817-2","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-release-candidate-1","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-6-release-candidate-1","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3505","name":"RHSA-2018:3505","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3041","name":"RHSA-2018:3041","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://www.debian.org/security/2018/dsa-4307","name":"DSA-4307","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://usn.ubuntu.com/3817-1/","name":"USN-3817-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html","name":"[debian-lts-announce] 20180925 [SECURITY] [DLA 1519-1] python2.7 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/","name":"FEDORA-2019-6e1938a3c5","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/","name":"FEDORA-2019-cf725dd20b","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/","name":"FEDORA-2019-51f1e08207","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://access.redhat.com/errata/RHBA-2019:0327","name":"RHBA-2019:0327","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1260","name":"RHSA-2019:1260","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03951en_us","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3725","name":"RHSA-2019:3725","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","name":"openSUSE-SU-2020:0086","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-05T03:51:48.415Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2018-1061","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T17:20:05.235311Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T17:20:16.677Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2020-01-21T21:06:16.000Z"}}},"related_cves":[{"value":"CVE-2018-1061","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ecfeb222-b3f9-4ad3-b015-afe48fd89cf2","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2018-1061","advisory_id":"ecfeb222-b3f9-4ad3-b015-afe48fd89cf2","event_types":["advisory"],"published_at":"2026-10-25T08:06:27.983447+00:00","technologies":["core-cve","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2018-06-19T12:00:00+00:00","detail_url":"/events/29881"},"members":[{"id":29881,"cve_ids":["CVE-2018-1061"],"payload":{"kind":"advisory","title":"CVE-2018-1061","summary":"python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK method. An attacker could use this flaw to cause denial of service.","evidence":"cve:CVE-2018-1061","products":[{"name":{"value":"python","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2018-1061","aliases":["CVE-2018-1061"],"metrics":[{"cvssV3_0":{"scope":"UNCHANGED","version":"3.0","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"[UNKNOWN]","product":"python","versions":[{"status":"affected","version":"python 2.7.15"},{"status":"affected","version":"python 3.4.9"},{"status":"affected","version":"python 3.5.6"},{"status":"affected","version":"python 3.7.0"}]}],"modified":"2026-10-15T17:20:16.677Z","provider":"cve","references":["https://www.debian.org/security/2018/dsa-4306","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1061","https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html","https://bugs.python.org/issue32981","https://usn.ubuntu.com/3817-2/","https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-release-candidate-1","https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-6-release-candidate-1","https://access.redhat.com/errata/RHSA-2018:3505","https://access.redhat.com/errata/RHSA-2018:3041","https://www.debian.org/security/2018/dsa-4307","https://usn.ubuntu.com/3817-1/","https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2019:1260","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03951en_us","https://access.redhat.com/errata/RHSA-2019:3725"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.debian.org/security/2018/dsa-4306","name":"DSA-4306","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1061","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.securitytracker.com/id/1042001","name":"1042001","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html","name":"[debian-lts-announce] 20180926 [SECURITY] [DLA 1520-1] python3.4 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://bugs.python.org/issue32981","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://usn.ubuntu.com/3817-2/","name":"USN-3817-2","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-release-candidate-1","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-6-release-candidate-1","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3505","name":"RHSA-2018:3505","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3041","name":"RHSA-2018:3041","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://www.debian.org/security/2018/dsa-4307","name":"DSA-4307","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://usn.ubuntu.com/3817-1/","name":"USN-3817-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html","name":"[debian-lts-announce] 20180925 [SECURITY] [DLA 1519-1] python2.7 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/","name":"FEDORA-2019-6e1938a3c5","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/","name":"FEDORA-2019-cf725dd20b","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/","name":"FEDORA-2019-51f1e08207","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://access.redhat.com/errata/RHBA-2019:0327","name":"RHBA-2019:0327","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1260","name":"RHSA-2019:1260","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03951en_us","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3725","name":"RHSA-2019:3725","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","name":"openSUSE-SU-2020:0086","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-05T03:51:48.415Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2018-1061","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T17:20:05.235311Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T17:20:16.677Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2020-01-21T21:06:16.000Z"}}},"related_cves":[{"value":"CVE-2018-1061","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ecfeb222-b3f9-4ad3-b015-afe48fd89cf2","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2018-1061","advisory_id":"ecfeb222-b3f9-4ad3-b015-afe48fd89cf2","event_types":["advisory"],"published_at":"2026-10-25T08:06:27.983447+00:00","technologies":["core-cve","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2018-06-19T12:00:00+00:00","detail_url":"/events/29881"}]}},{"id":21950,"cve_ids":["CVE-2022-0391"],"payload":{"kind":"advisory","title":"CVE-2022-0391","summary":"A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\\r' and '\\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14.","evidence":"cve:CVE-2022-0391","products":[{"name":{"value":"python","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2022-0391","aliases":["CVE-2022-0391"],"metrics":[],"affected":[{"vendor":"n/a","product":"python","versions":[{"status":"affected","version":"python 3.10.0b1, python 3.9.5, python 3.8.11, python 3.7.11, python 3.6.14"}]}],"modified":"2026-10-14T12:12:30.872Z","provider":"cve","references":["https://bugs.python.org/issue43882","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDBDBAU6HUPZHISBOARTXZ5GKHF2VH5U/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CSD2YBXP3ZF44E44QMIIAR5VTO35KTRB/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://security.netapp.com/advisory/ntap-20220225-0009/","https://security.gentoo.org/glsa/202305-02","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://bugs.python.org/issue43882","tags":["x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDBDBAU6HUPZHISBOARTXZ5GKHF2VH5U/","name":"FEDORA-2022-ef99a016f6","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CSD2YBXP3ZF44E44QMIIAR5VTO35KTRB/","name":"FEDORA-2022-18ad73aba6","tags":["vendor-advisory","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20220225-0009/","tags":["x_transferred"]},{"url":"https://security.gentoo.org/glsa/202305-02","name":"GLSA-202305-02","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","name":"[debian-lts-announce] 20230920 [SECURITY] [DLA 3575-1] python2.7 security update","tags":["mailing-list","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html"},{"url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T21:45:36.139Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2022-0391","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2025-12-17T20:58:36.919543Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-12-17T20:58:43.991Z"}},{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"}],"x_adpType":"supplier","references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html"}],"providerMetadata":{"orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP","dateUpdated":"2026-10-14T12:12:30.872Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2023-09-20T21:06:09.930Z"}}},"related_cves":[{"value":"CVE-2022-0391","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b8ec127c-de92-4db1-8c10-6541947a7168","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2022-0391","advisory_id":"b8ec127c-de92-4db1-8c10-6541947a7168","event_types":["advisory"],"published_at":"2026-10-25T05:51:26.618408+00:00","technologies":["core-cve","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2022-02-09T00:00:00+00:00","detail_url":"/advisories/advisory%3Ab8ec127c-de92-4db1-8c10-6541947a7168","group":{"id":"advisory:b8ec127c-de92-4db1-8c10-6541947a7168","revision":1,"primary_event_id":21795,"change":"published","superseded_by":[],"changed":{"id":21795,"cve_ids":["CVE-2022-0391"],"payload":{"kind":"advisory","title":"CVE-2022-0391","summary":"A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\\r' and '\\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14.","evidence":"cve:CVE-2022-0391","products":[{"name":{"value":"python","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2022-0391","aliases":["CVE-2022-0391"],"metrics":[],"affected":[{"vendor":"n/a","product":"python","versions":[{"status":"affected","version":"python 3.10.0b1, python 3.9.5, python 3.8.11, python 3.7.11, python 3.6.14"}]}],"modified":"2026-10-14T12:12:30.872Z","provider":"cve","references":["https://bugs.python.org/issue43882","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDBDBAU6HUPZHISBOARTXZ5GKHF2VH5U/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CSD2YBXP3ZF44E44QMIIAR5VTO35KTRB/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://security.netapp.com/advisory/ntap-20220225-0009/","https://security.gentoo.org/glsa/202305-02","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://bugs.python.org/issue43882","tags":["x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDBDBAU6HUPZHISBOARTXZ5GKHF2VH5U/","name":"FEDORA-2022-ef99a016f6","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CSD2YBXP3ZF44E44QMIIAR5VTO35KTRB/","name":"FEDORA-2022-18ad73aba6","tags":["vendor-advisory","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20220225-0009/","tags":["x_transferred"]},{"url":"https://security.gentoo.org/glsa/202305-02","name":"GLSA-202305-02","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","name":"[debian-lts-announce] 20230920 [SECURITY] [DLA 3575-1] python2.7 security update","tags":["mailing-list","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html"},{"url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T21:45:36.139Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2022-0391","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2025-12-17T20:58:36.919543Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-12-17T20:58:43.991Z"}},{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"}],"x_adpType":"supplier","references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html"}],"providerMetadata":{"orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP","dateUpdated":"2026-10-14T12:12:30.872Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2023-09-20T21:06:09.930Z"}}},"related_cves":[{"value":"CVE-2022-0391","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b8ec127c-de92-4db1-8c10-6541947a7168","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2022-0391","advisory_id":"b8ec127c-de92-4db1-8c10-6541947a7168","event_types":["advisory"],"published_at":"2026-10-25T05:51:26.618408+00:00","technologies":["core-cve","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2022-02-09T00:00:00+00:00","detail_url":"/events/21795"},"members":[{"id":21795,"cve_ids":["CVE-2022-0391"],"payload":{"kind":"advisory","title":"CVE-2022-0391","summary":"A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\\r' and '\\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14.","evidence":"cve:CVE-2022-0391","products":[{"name":{"value":"python","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2022-0391","aliases":["CVE-2022-0391"],"metrics":[],"affected":[{"vendor":"n/a","product":"python","versions":[{"status":"affected","version":"python 3.10.0b1, python 3.9.5, python 3.8.11, python 3.7.11, python 3.6.14"}]}],"modified":"2026-10-14T12:12:30.872Z","provider":"cve","references":["https://bugs.python.org/issue43882","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDBDBAU6HUPZHISBOARTXZ5GKHF2VH5U/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CSD2YBXP3ZF44E44QMIIAR5VTO35KTRB/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://security.netapp.com/advisory/ntap-20220225-0009/","https://security.gentoo.org/glsa/202305-02","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://bugs.python.org/issue43882","tags":["x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDBDBAU6HUPZHISBOARTXZ5GKHF2VH5U/","name":"FEDORA-2022-ef99a016f6","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CSD2YBXP3ZF44E44QMIIAR5VTO35KTRB/","name":"FEDORA-2022-18ad73aba6","tags":["vendor-advisory","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20220225-0009/","tags":["x_transferred"]},{"url":"https://security.gentoo.org/glsa/202305-02","name":"GLSA-202305-02","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","name":"[debian-lts-announce] 20230920 [SECURITY] [DLA 3575-1] python2.7 security update","tags":["mailing-list","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html"},{"url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T21:45:36.139Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2022-0391","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2025-12-17T20:58:36.919543Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-12-17T20:58:43.991Z"}},{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"}],"x_adpType":"supplier","references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html"}],"providerMetadata":{"orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP","dateUpdated":"2026-10-14T12:12:30.872Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2023-09-20T21:06:09.930Z"}}},"related_cves":[{"value":"CVE-2022-0391","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b8ec127c-de92-4db1-8c10-6541947a7168","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2022-0391","advisory_id":"b8ec127c-de92-4db1-8c10-6541947a7168","event_types":["advisory"],"published_at":"2026-10-25T05:51:26.618408+00:00","technologies":["core-cve","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2022-02-09T00:00:00+00:00","detail_url":"/events/21795"}]}},{"id":21809,"cve_ids":["CVE-2021-4189"],"payload":{"kind":"advisory","title":"CVE-2021-4189","summary":"A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible.","evidence":"cve:CVE-2021-4189","products":[{"name":{"value":"python","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-4189","aliases":["CVE-2021-4189"],"metrics":[],"affected":[{"vendor":"n/a","product":"python","versions":[{"status":"affected","version":"Fixed in python 3.6.14, python 3.7.11, python 3.8.9, python 3.9.3, python 3.10.0"}]}],"modified":"2026-10-14T10:04:06.190Z","provider":"cve","references":["https://bugs.python.org/issue43285","https://python-security.readthedocs.io/vuln/ftplib-pasv.html","https://github.com/python/cpython/commit/0ab152c6b5d95caa2dc1a30fa96e10258b5f188e","https://security-tracker.debian.org/tracker/CVE-2021-4189","https://bugzilla.redhat.com/show_bug.cgi?id=2036020","https://access.redhat.com/security/cve/CVE-2021-4189","https://security.netapp.com/advisory/ntap-20221104-0004/","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://bugs.python.org/issue43285","tags":["x_transferred"]},{"url":"https://python-security.readthedocs.io/vuln/ftplib-pasv.html","tags":["x_transferred"]},{"url":"https://github.com/python/cpython/commit/0ab152c6b5d95caa2dc1a30fa96e10258b5f188e","tags":["x_transferred"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-4189","tags":["x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2036020","tags":["x_transferred"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-4189","tags":["x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20221104-0004/","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","name":"[debian-lts-announce] 20230524 [SECURITY] [DLA 3432-1] python2.7 security update","tags":["mailing-list","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","name":"[debian-lts-announce] 20230630 [SECURITY] [DLA 3477-1] python3.7 security update","tags":["mailing-list","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T21:45:21.395Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"id":"CVE-2021-4189","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2025-06-25T14:59:42.470722Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-252","description":"CWE-252 Unchecked Return Value"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-12-17T21:36:07.876Z"}},{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"}],"x_adpType":"supplier","references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html"}],"providerMetadata":{"orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP","dateUpdated":"2026-10-14T10:04:06.190Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2023-06-30T00:00:00.000Z"}}},"related_cves":[{"value":"CVE-2021-4189","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ae9fa831-addc-4fe3-bb57-b6959f66d29e","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-4189","advisory_id":"ae9fa831-addc-4fe3-bb57-b6959f66d29e","event_types":["advisory"],"published_at":"2026-10-25T05:48:29.451758+00:00","technologies":["core-cve","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2022-08-24T00:00:00+00:00","detail_url":"/advisories/advisory%3Aae9fa831-addc-4fe3-bb57-b6959f66d29e","group":{"id":"advisory:ae9fa831-addc-4fe3-bb57-b6959f66d29e","revision":1,"primary_event_id":21656,"change":"published","superseded_by":[],"changed":{"id":21656,"cve_ids":["CVE-2021-4189"],"payload":{"kind":"advisory","title":"CVE-2021-4189","summary":"A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible.","evidence":"cve:CVE-2021-4189","products":[{"name":{"value":"python","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-4189","aliases":["CVE-2021-4189"],"metrics":[],"affected":[{"vendor":"n/a","product":"python","versions":[{"status":"affected","version":"Fixed in python 3.6.14, python 3.7.11, python 3.8.9, python 3.9.3, python 3.10.0"}]}],"modified":"2026-10-14T10:04:06.190Z","provider":"cve","references":["https://bugs.python.org/issue43285","https://python-security.readthedocs.io/vuln/ftplib-pasv.html","https://github.com/python/cpython/commit/0ab152c6b5d95caa2dc1a30fa96e10258b5f188e","https://security-tracker.debian.org/tracker/CVE-2021-4189","https://bugzilla.redhat.com/show_bug.cgi?id=2036020","https://access.redhat.com/security/cve/CVE-2021-4189","https://security.netapp.com/advisory/ntap-20221104-0004/","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://bugs.python.org/issue43285","tags":["x_transferred"]},{"url":"https://python-security.readthedocs.io/vuln/ftplib-pasv.html","tags":["x_transferred"]},{"url":"https://github.com/python/cpython/commit/0ab152c6b5d95caa2dc1a30fa96e10258b5f188e","tags":["x_transferred"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-4189","tags":["x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2036020","tags":["x_transferred"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-4189","tags":["x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20221104-0004/","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","name":"[debian-lts-announce] 20230524 [SECURITY] [DLA 3432-1] python2.7 security update","tags":["mailing-list","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","name":"[debian-lts-announce] 20230630 [SECURITY] [DLA 3477-1] python3.7 security update","tags":["mailing-list","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T21:45:21.395Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"id":"CVE-2021-4189","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2025-06-25T14:59:42.470722Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-252","description":"CWE-252 Unchecked Return Value"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-12-17T21:36:07.876Z"}},{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"}],"x_adpType":"supplier","references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html"}],"providerMetadata":{"orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP","dateUpdated":"2026-10-14T10:04:06.190Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2023-06-30T00:00:00.000Z"}}},"related_cves":[{"value":"CVE-2021-4189","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ae9fa831-addc-4fe3-bb57-b6959f66d29e","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-4189","advisory_id":"ae9fa831-addc-4fe3-bb57-b6959f66d29e","event_types":["advisory"],"published_at":"2026-10-25T05:48:29.451758+00:00","technologies":["core-cve","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2022-08-24T00:00:00+00:00","detail_url":"/events/21656"},"members":[{"id":21656,"cve_ids":["CVE-2021-4189"],"payload":{"kind":"advisory","title":"CVE-2021-4189","summary":"A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible.","evidence":"cve:CVE-2021-4189","products":[{"name":{"value":"python","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-4189","aliases":["CVE-2021-4189"],"metrics":[],"affected":[{"vendor":"n/a","product":"python","versions":[{"status":"affected","version":"Fixed in python 3.6.14, python 3.7.11, python 3.8.9, python 3.9.3, python 3.10.0"}]}],"modified":"2026-10-14T10:04:06.190Z","provider":"cve","references":["https://bugs.python.org/issue43285","https://python-security.readthedocs.io/vuln/ftplib-pasv.html","https://github.com/python/cpython/commit/0ab152c6b5d95caa2dc1a30fa96e10258b5f188e","https://security-tracker.debian.org/tracker/CVE-2021-4189","https://bugzilla.redhat.com/show_bug.cgi?id=2036020","https://access.redhat.com/security/cve/CVE-2021-4189","https://security.netapp.com/advisory/ntap-20221104-0004/","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://bugs.python.org/issue43285","tags":["x_transferred"]},{"url":"https://python-security.readthedocs.io/vuln/ftplib-pasv.html","tags":["x_transferred"]},{"url":"https://github.com/python/cpython/commit/0ab152c6b5d95caa2dc1a30fa96e10258b5f188e","tags":["x_transferred"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-4189","tags":["x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2036020","tags":["x_transferred"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-4189","tags":["x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20221104-0004/","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","name":"[debian-lts-announce] 20230524 [SECURITY] [DLA 3432-1] python2.7 security update","tags":["mailing-list","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","name":"[debian-lts-announce] 20230630 [SECURITY] [DLA 3477-1] python3.7 security update","tags":["mailing-list","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T21:45:21.395Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"id":"CVE-2021-4189","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2025-06-25T14:59:42.470722Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-252","description":"CWE-252 Unchecked Return Value"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-12-17T21:36:07.876Z"}},{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"}],"x_adpType":"supplier","references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html"}],"providerMetadata":{"orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP","dateUpdated":"2026-10-14T10:04:06.190Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2023-06-30T00:00:00.000Z"}}},"related_cves":[{"value":"CVE-2021-4189","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ae9fa831-addc-4fe3-bb57-b6959f66d29e","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-4189","advisory_id":"ae9fa831-addc-4fe3-bb57-b6959f66d29e","event_types":["advisory"],"published_at":"2026-10-25T05:48:29.451758+00:00","technologies":["core-cve","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2022-08-24T00:00:00+00:00","detail_url":"/events/21656"}]}},{"id":21791,"cve_ids":["CVE-2021-3737"],"payload":{"kind":"advisory","title":"CVE-2021-3737","summary":"A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability.","evidence":"cve:CVE-2021-3737","products":[{"name":{"value":"python","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-3737","aliases":["CVE-2021-3737"],"metrics":[],"affected":[{"vendor":"n/a","product":"python","versions":[{"status":"affected","version":"Fixed in python v3.6.14, python v3.7.11, python v3.8.11, python v3.9.6, python v3.10.0b2"}]}],"modified":"2026-10-14T09:49:50.701Z","provider":"cve","references":["https://bugs.python.org/issue44022","https://github.com/python/cpython/pull/25916","https://bugzilla.redhat.com/show_bug.cgi?id=1995162","https://github.com/python/cpython/pull/26503","https://ubuntu.com/security/CVE-2021-3737","https://www.oracle.com/security-alerts/cpujul2022.html","https://python-security.readthedocs.io/vuln/urllib-100-continue-loop.html","https://security.netapp.com/advisory/ntap-20220407-0009/","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://bugs.python.org/issue44022","tags":["x_transferred"]},{"url":"https://github.com/python/cpython/pull/25916","tags":["x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1995162","tags":["x_transferred"]},{"url":"https://github.com/python/cpython/pull/26503","tags":["x_transferred"]},{"url":"https://ubuntu.com/security/CVE-2021-3737","tags":["x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["x_transferred"]},{"url":"https://python-security.readthedocs.io/vuln/urllib-100-continue-loop.html","tags":["x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20220407-0009/","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","name":"[debian-lts-announce] 20230524 [SECURITY] [DLA 3432-1] python2.7 security update","tags":["mailing-list","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","name":"[debian-lts-announce] 20230630 [SECURITY] [DLA 3477-1] python3.7 security update","tags":["mailing-list","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"},{"url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T21:45:09.305Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2021-3737","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2025-12-17T21:32:43.233615Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-12-17T21:32:47.732Z"}},{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"}],"x_adpType":"supplier","references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html"}],"providerMetadata":{"orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP","dateUpdated":"2026-10-14T09:49:50.701Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2023-06-30T00:00:00.000Z"}}},"related_cves":[{"value":"CVE-2021-3737","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:92ca1e0c-e9c7-48ab-a685-d6d956b4446f","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-3737","advisory_id":"92ca1e0c-e9c7-48ab-a685-d6d956b4446f","event_types":["advisory"],"published_at":"2026-10-25T05:48:18.605466+00:00","technologies":["core-cve","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2022-03-04T00:00:00+00:00","detail_url":"/advisories/advisory%3A92ca1e0c-e9c7-48ab-a685-d6d956b4446f","group":{"id":"advisory:92ca1e0c-e9c7-48ab-a685-d6d956b4446f","revision":1,"primary_event_id":21638,"change":"published","superseded_by":[],"changed":{"id":21638,"cve_ids":["CVE-2021-3737"],"payload":{"kind":"advisory","title":"CVE-2021-3737","summary":"A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability.","evidence":"cve:CVE-2021-3737","products":[{"name":{"value":"python","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-3737","aliases":["CVE-2021-3737"],"metrics":[],"affected":[{"vendor":"n/a","product":"python","versions":[{"status":"affected","version":"Fixed in python v3.6.14, python v3.7.11, python v3.8.11, python v3.9.6, python v3.10.0b2"}]}],"modified":"2026-10-14T09:49:50.701Z","provider":"cve","references":["https://bugs.python.org/issue44022","https://github.com/python/cpython/pull/25916","https://bugzilla.redhat.com/show_bug.cgi?id=1995162","https://github.com/python/cpython/pull/26503","https://ubuntu.com/security/CVE-2021-3737","https://www.oracle.com/security-alerts/cpujul2022.html","https://python-security.readthedocs.io/vuln/urllib-100-continue-loop.html","https://security.netapp.com/advisory/ntap-20220407-0009/","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://bugs.python.org/issue44022","tags":["x_transferred"]},{"url":"https://github.com/python/cpython/pull/25916","tags":["x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1995162","tags":["x_transferred"]},{"url":"https://github.com/python/cpython/pull/26503","tags":["x_transferred"]},{"url":"https://ubuntu.com/security/CVE-2021-3737","tags":["x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["x_transferred"]},{"url":"https://python-security.readthedocs.io/vuln/urllib-100-continue-loop.html","tags":["x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20220407-0009/","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","name":"[debian-lts-announce] 20230524 [SECURITY] [DLA 3432-1] python2.7 security update","tags":["mailing-list","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","name":"[debian-lts-announce] 20230630 [SECURITY] [DLA 3477-1] python3.7 security update","tags":["mailing-list","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"},{"url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T21:45:09.305Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2021-3737","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2025-12-17T21:32:43.233615Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-12-17T21:32:47.732Z"}},{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"}],"x_adpType":"supplier","references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html"}],"providerMetadata":{"orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP","dateUpdated":"2026-10-14T09:49:50.701Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2023-06-30T00:00:00.000Z"}}},"related_cves":[{"value":"CVE-2021-3737","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:92ca1e0c-e9c7-48ab-a685-d6d956b4446f","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-3737","advisory_id":"92ca1e0c-e9c7-48ab-a685-d6d956b4446f","event_types":["advisory"],"published_at":"2026-10-25T05:48:18.605466+00:00","technologies":["core-cve","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2022-03-04T00:00:00+00:00","detail_url":"/events/21638"},"members":[{"id":21638,"cve_ids":["CVE-2021-3737"],"payload":{"kind":"advisory","title":"CVE-2021-3737","summary":"A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability.","evidence":"cve:CVE-2021-3737","products":[{"name":{"value":"python","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-3737","aliases":["CVE-2021-3737"],"metrics":[],"affected":[{"vendor":"n/a","product":"python","versions":[{"status":"affected","version":"Fixed in python v3.6.14, python v3.7.11, python v3.8.11, python v3.9.6, python v3.10.0b2"}]}],"modified":"2026-10-14T09:49:50.701Z","provider":"cve","references":["https://bugs.python.org/issue44022","https://github.com/python/cpython/pull/25916","https://bugzilla.redhat.com/show_bug.cgi?id=1995162","https://github.com/python/cpython/pull/26503","https://ubuntu.com/security/CVE-2021-3737","https://www.oracle.com/security-alerts/cpujul2022.html","https://python-security.readthedocs.io/vuln/urllib-100-continue-loop.html","https://security.netapp.com/advisory/ntap-20220407-0009/","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://bugs.python.org/issue44022","tags":["x_transferred"]},{"url":"https://github.com/python/cpython/pull/25916","tags":["x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1995162","tags":["x_transferred"]},{"url":"https://github.com/python/cpython/pull/26503","tags":["x_transferred"]},{"url":"https://ubuntu.com/security/CVE-2021-3737","tags":["x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["x_transferred"]},{"url":"https://python-security.readthedocs.io/vuln/urllib-100-continue-loop.html","tags":["x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20220407-0009/","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","name":"[debian-lts-announce] 20230524 [SECURITY] [DLA 3432-1] python2.7 security update","tags":["mailing-list","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","name":"[debian-lts-announce] 20230630 [SECURITY] [DLA 3477-1] python3.7 security update","tags":["mailing-list","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"},{"url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T21:45:09.305Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2021-3737","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2025-12-17T21:32:43.233615Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-12-17T21:32:47.732Z"}},{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"}],"x_adpType":"supplier","references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html"}],"providerMetadata":{"orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP","dateUpdated":"2026-10-14T09:49:50.701Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2023-06-30T00:00:00.000Z"}}},"related_cves":[{"value":"CVE-2021-3737","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:92ca1e0c-e9c7-48ab-a685-d6d956b4446f","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-3737","advisory_id":"92ca1e0c-e9c7-48ab-a685-d6d956b4446f","event_types":["advisory"],"published_at":"2026-10-25T05:48:18.605466+00:00","technologies":["core-cve","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2022-03-04T00:00:00+00:00","detail_url":"/events/21638"}]}},{"id":21790,"cve_ids":["CVE-2021-3733"],"payload":{"kind":"advisory","title":"CVE-2021-3733","summary":"There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.","evidence":"cve:CVE-2021-3733","products":[{"name":{"value":"python","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-3733","aliases":["CVE-2021-3733"],"metrics":[],"affected":[{"vendor":"n/a","product":"python","versions":[{"status":"affected","version":"Fixed in python v3.6.14, python v3.7.11, python v3.8.10, python v3.9.5."}]}],"modified":"2026-10-14T09:49:49.275Z","provider":"cve","references":["https://bugs.python.org/issue43075","https://bugzilla.redhat.com/show_bug.cgi?id=1995234","https://github.com/python/cpython/pull/24391","https://ubuntu.com/security/CVE-2021-3733","https://github.com/python/cpython/commit/7215d1ae25525c92b026166f9d5cac85fb","https://security.netapp.com/advisory/ntap-20220407-0001/","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://bugs.python.org/issue43075","tags":["x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1995234","tags":["x_transferred"]},{"url":"https://github.com/python/cpython/pull/24391","tags":["x_transferred"]},{"url":"https://ubuntu.com/security/CVE-2021-3733","tags":["x_transferred"]},{"url":"https://github.com/python/cpython/commit/7215d1ae25525c92b026166f9d5cac85fb","tags":["x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20220407-0001/","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","name":"[debian-lts-announce] 20230524 [SECURITY] [DLA 3432-1] python2.7 security update","tags":["mailing-list","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","name":"[debian-lts-announce] 20230630 [SECURITY] [DLA 3477-1] python3.7 security update","tags":["mailing-list","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T21:45:06.299Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2021-3733","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-08T20:57:59.983466Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T21:03:21.189Z"}},{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"}],"x_adpType":"supplier","references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html"}],"providerMetadata":{"orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP","dateUpdated":"2026-10-14T09:49:49.275Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2023-06-30T00:00:00.000Z"}}},"related_cves":[{"value":"CVE-2021-3733","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:82c5d53e-0627-46cc-824a-b558b2c88fcb","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-3733","advisory_id":"82c5d53e-0627-46cc-824a-b558b2c88fcb","event_types":["advisory"],"published_at":"2026-10-25T05:48:17.999694+00:00","technologies":["core-cve","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2022-03-07T00:00:00+00:00","detail_url":"/advisories/advisory%3A82c5d53e-0627-46cc-824a-b558b2c88fcb","group":{"id":"advisory:82c5d53e-0627-46cc-824a-b558b2c88fcb","revision":1,"primary_event_id":21637,"change":"published","superseded_by":[],"changed":{"id":21637,"cve_ids":["CVE-2021-3733"],"payload":{"kind":"advisory","title":"CVE-2021-3733","summary":"There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.","evidence":"cve:CVE-2021-3733","products":[{"name":{"value":"python","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-3733","aliases":["CVE-2021-3733"],"metrics":[],"affected":[{"vendor":"n/a","product":"python","versions":[{"status":"affected","version":"Fixed in python v3.6.14, python v3.7.11, python v3.8.10, python v3.9.5."}]}],"modified":"2026-10-14T09:49:49.275Z","provider":"cve","references":["https://bugs.python.org/issue43075","https://bugzilla.redhat.com/show_bug.cgi?id=1995234","https://github.com/python/cpython/pull/24391","https://ubuntu.com/security/CVE-2021-3733","https://github.com/python/cpython/commit/7215d1ae25525c92b026166f9d5cac85fb","https://security.netapp.com/advisory/ntap-20220407-0001/","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://bugs.python.org/issue43075","tags":["x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1995234","tags":["x_transferred"]},{"url":"https://github.com/python/cpython/pull/24391","tags":["x_transferred"]},{"url":"https://ubuntu.com/security/CVE-2021-3733","tags":["x_transferred"]},{"url":"https://github.com/python/cpython/commit/7215d1ae25525c92b026166f9d5cac85fb","tags":["x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20220407-0001/","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","name":"[debian-lts-announce] 20230524 [SECURITY] [DLA 3432-1] python2.7 security update","tags":["mailing-list","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","name":"[debian-lts-announce] 20230630 [SECURITY] [DLA 3477-1] python3.7 security update","tags":["mailing-list","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T21:45:06.299Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2021-3733","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-08T20:57:59.983466Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T21:03:21.189Z"}},{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"}],"x_adpType":"supplier","references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html"}],"providerMetadata":{"orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP","dateUpdated":"2026-10-14T09:49:49.275Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2023-06-30T00:00:00.000Z"}}},"related_cves":[{"value":"CVE-2021-3733","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:82c5d53e-0627-46cc-824a-b558b2c88fcb","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-3733","advisory_id":"82c5d53e-0627-46cc-824a-b558b2c88fcb","event_types":["advisory"],"published_at":"2026-10-25T05:48:17.999694+00:00","technologies":["core-cve","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2022-03-07T00:00:00+00:00","detail_url":"/events/21637"},"members":[{"id":21637,"cve_ids":["CVE-2021-3733"],"payload":{"kind":"advisory","title":"CVE-2021-3733","summary":"There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.","evidence":"cve:CVE-2021-3733","products":[{"name":{"value":"python","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-3733","aliases":["CVE-2021-3733"],"metrics":[],"affected":[{"vendor":"n/a","product":"python","versions":[{"status":"affected","version":"Fixed in python v3.6.14, python v3.7.11, python v3.8.10, python v3.9.5."}]}],"modified":"2026-10-14T09:49:49.275Z","provider":"cve","references":["https://bugs.python.org/issue43075","https://bugzilla.redhat.com/show_bug.cgi?id=1995234","https://github.com/python/cpython/pull/24391","https://ubuntu.com/security/CVE-2021-3733","https://github.com/python/cpython/commit/7215d1ae25525c92b026166f9d5cac85fb","https://security.netapp.com/advisory/ntap-20220407-0001/","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://bugs.python.org/issue43075","tags":["x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1995234","tags":["x_transferred"]},{"url":"https://github.com/python/cpython/pull/24391","tags":["x_transferred"]},{"url":"https://ubuntu.com/security/CVE-2021-3733","tags":["x_transferred"]},{"url":"https://github.com/python/cpython/commit/7215d1ae25525c92b026166f9d5cac85fb","tags":["x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20220407-0001/","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","name":"[debian-lts-announce] 20230524 [SECURITY] [DLA 3432-1] python2.7 security update","tags":["mailing-list","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","name":"[debian-lts-announce] 20230630 [SECURITY] [DLA 3477-1] python3.7 security update","tags":["mailing-list","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T21:45:06.299Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2021-3733","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-08T20:57:59.983466Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T21:03:21.189Z"}},{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"}],"x_adpType":"supplier","references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html"}],"providerMetadata":{"orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP","dateUpdated":"2026-10-14T09:49:49.275Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2023-06-30T00:00:00.000Z"}}},"related_cves":[{"value":"CVE-2021-3733","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:82c5d53e-0627-46cc-824a-b558b2c88fcb","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-3733","advisory_id":"82c5d53e-0627-46cc-824a-b558b2c88fcb","event_types":["advisory"],"published_at":"2026-10-25T05:48:17.999694+00:00","technologies":["core-cve","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2022-03-07T00:00:00+00:00","detail_url":"/events/21637"}]}},{"id":21781,"cve_ids":["CVE-2021-3426"],"payload":{"kind":"advisory","title":"CVE-2021-3426","summary":"There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server could access the server and use it to disclose sensitive information belonging to the other user that they would not normally be able to access. The highest risk of this flaw is to data confidentiality. This flaw affects Python versions before 3.8.9, Python versions before 3.9.3 and Python versions before 3.10.0a7.","evidence":"cve:CVE-2021-3426","products":[{"name":{"value":"python","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-3426","aliases":["CVE-2021-3426"],"metrics":[],"affected":[{"vendor":"n/a","product":"python","versions":[{"status":"affected","version":"python 3.8.9, python 3.9.3, python 3.10.0a7"}]}],"modified":"2026-10-14T09:49:37.022Z","provider":"cve","references":["https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/25HVHLBGO2KNPXJ3G426QEYSSCECJDU5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VPX7Y5GQDNB4FJTREWONGC4ZSVH7TGHF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DQYPUKLLBOZMKFPO7RD7CENTXHUUEUV7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QNGAFMPIYIVJ47FCF2NK2PIX22HUG35B/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BF2K7HEWADHN6P52R3QLIOX27U3DJ4HI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LM5V4VPLBHBEASSAROYPSHXGXGGPHNOE/","https://security.gentoo.org/glsa/202104-04","https://bugzilla.redhat.com/show_bug.cgi?id=1935913","https://www.oracle.com/security-alerts/cpuoct2021.html","https://security.netapp.com/advisory/ntap-20210629-0003/","https://www.oracle.com/security-alerts/cpujan2022.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","name":"[debian-lts-announce] 20210405 [SECURITY] [DLA 2619-1] python3.5 security update","tags":["mailing-list","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/25HVHLBGO2KNPXJ3G426QEYSSCECJDU5/","name":"FEDORA-2021-a311bf10d4","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VPX7Y5GQDNB4FJTREWONGC4ZSVH7TGHF/","name":"FEDORA-2021-2ab6f060d9","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DQYPUKLLBOZMKFPO7RD7CENTXHUUEUV7/","name":"FEDORA-2021-1769a23935","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/","name":"FEDORA-2021-b6b6093b3a","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QNGAFMPIYIVJ47FCF2NK2PIX22HUG35B/","name":"FEDORA-2021-067c9deff1","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BF2K7HEWADHN6P52R3QLIOX27U3DJ4HI/","name":"FEDORA-2021-0a8f3ffbc0","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LM5V4VPLBHBEASSAROYPSHXGXGGPHNOE/","name":"FEDORA-2021-a26257ccf5","tags":["vendor-advisory","x_transferred"]},{"url":"https://security.gentoo.org/glsa/202104-04","name":"GLSA-202104-04","tags":["vendor-advisory","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1935913","tags":["x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20210629-0003/","tags":["x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","name":"[debian-lts-announce] 20230630 [SECURITY] [DLA 3477-1] python3.7 security update","tags":["mailing-list","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T21:44:51.975Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.7,"attackVector":"ADJACENT_NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2021-3426","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2025-12-18T11:45:51.350788Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-12-18T11:45:56.551Z"}},{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"}],"x_adpType":"supplier","references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html"}],"providerMetadata":{"orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP","dateUpdated":"2026-10-14T09:49:37.022Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2023-06-30T00:00:00.000Z"}}},"related_cves":[{"value":"CVE-2021-3426","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:a4b2edba-fbe9-422c-9a18-35654ca08a13","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-3426","advisory_id":"a4b2edba-fbe9-422c-9a18-35654ca08a13","event_types":["advisory"],"published_at":"2026-10-25T05:48:12.447193+00:00","technologies":["core-cve","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-05-20T00:00:00+00:00","detail_url":"/advisories/advisory%3Aa4b2edba-fbe9-422c-9a18-35654ca08a13","group":{"id":"advisory:a4b2edba-fbe9-422c-9a18-35654ca08a13","revision":1,"primary_event_id":21628,"change":"published","superseded_by":[],"changed":{"id":21628,"cve_ids":["CVE-2021-3426"],"payload":{"kind":"advisory","title":"CVE-2021-3426","summary":"There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server could access the server and use it to disclose sensitive information belonging to the other user that they would not normally be able to access. The highest risk of this flaw is to data confidentiality. This flaw affects Python versions before 3.8.9, Python versions before 3.9.3 and Python versions before 3.10.0a7.","evidence":"cve:CVE-2021-3426","products":[{"name":{"value":"python","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-3426","aliases":["CVE-2021-3426"],"metrics":[],"affected":[{"vendor":"n/a","product":"python","versions":[{"status":"affected","version":"python 3.8.9, python 3.9.3, python 3.10.0a7"}]}],"modified":"2026-10-14T09:49:37.022Z","provider":"cve","references":["https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/25HVHLBGO2KNPXJ3G426QEYSSCECJDU5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VPX7Y5GQDNB4FJTREWONGC4ZSVH7TGHF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DQYPUKLLBOZMKFPO7RD7CENTXHUUEUV7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QNGAFMPIYIVJ47FCF2NK2PIX22HUG35B/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BF2K7HEWADHN6P52R3QLIOX27U3DJ4HI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LM5V4VPLBHBEASSAROYPSHXGXGGPHNOE/","https://security.gentoo.org/glsa/202104-04","https://bugzilla.redhat.com/show_bug.cgi?id=1935913","https://www.oracle.com/security-alerts/cpuoct2021.html","https://security.netapp.com/advisory/ntap-20210629-0003/","https://www.oracle.com/security-alerts/cpujan2022.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","name":"[debian-lts-announce] 20210405 [SECURITY] [DLA 2619-1] python3.5 security update","tags":["mailing-list","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/25HVHLBGO2KNPXJ3G426QEYSSCECJDU5/","name":"FEDORA-2021-a311bf10d4","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VPX7Y5GQDNB4FJTREWONGC4ZSVH7TGHF/","name":"FEDORA-2021-2ab6f060d9","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DQYPUKLLBOZMKFPO7RD7CENTXHUUEUV7/","name":"FEDORA-2021-1769a23935","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/","name":"FEDORA-2021-b6b6093b3a","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QNGAFMPIYIVJ47FCF2NK2PIX22HUG35B/","name":"FEDORA-2021-067c9deff1","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BF2K7HEWADHN6P52R3QLIOX27U3DJ4HI/","name":"FEDORA-2021-0a8f3ffbc0","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LM5V4VPLBHBEASSAROYPSHXGXGGPHNOE/","name":"FEDORA-2021-a26257ccf5","tags":["vendor-advisory","x_transferred"]},{"url":"https://security.gentoo.org/glsa/202104-04","name":"GLSA-202104-04","tags":["vendor-advisory","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1935913","tags":["x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20210629-0003/","tags":["x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","name":"[debian-lts-announce] 20230630 [SECURITY] [DLA 3477-1] python3.7 security update","tags":["mailing-list","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T21:44:51.975Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.7,"attackVector":"ADJACENT_NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2021-3426","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2025-12-18T11:45:51.350788Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-12-18T11:45:56.551Z"}},{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"}],"x_adpType":"supplier","references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html"}],"providerMetadata":{"orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP","dateUpdated":"2026-10-14T09:49:37.022Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2023-06-30T00:00:00.000Z"}}},"related_cves":[{"value":"CVE-2021-3426","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:a4b2edba-fbe9-422c-9a18-35654ca08a13","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-3426","advisory_id":"a4b2edba-fbe9-422c-9a18-35654ca08a13","event_types":["advisory"],"published_at":"2026-10-25T05:48:12.447193+00:00","technologies":["core-cve","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-05-20T00:00:00+00:00","detail_url":"/events/21628"},"members":[{"id":21628,"cve_ids":["CVE-2021-3426"],"payload":{"kind":"advisory","title":"CVE-2021-3426","summary":"There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server could access the server and use it to disclose sensitive information belonging to the other user that they would not normally be able to access. The highest risk of this flaw is to data confidentiality. This flaw affects Python versions before 3.8.9, Python versions before 3.9.3 and Python versions before 3.10.0a7.","evidence":"cve:CVE-2021-3426","products":[{"name":{"value":"python","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-3426","aliases":["CVE-2021-3426"],"metrics":[],"affected":[{"vendor":"n/a","product":"python","versions":[{"status":"affected","version":"python 3.8.9, python 3.9.3, python 3.10.0a7"}]}],"modified":"2026-10-14T09:49:37.022Z","provider":"cve","references":["https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/25HVHLBGO2KNPXJ3G426QEYSSCECJDU5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VPX7Y5GQDNB4FJTREWONGC4ZSVH7TGHF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DQYPUKLLBOZMKFPO7RD7CENTXHUUEUV7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QNGAFMPIYIVJ47FCF2NK2PIX22HUG35B/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BF2K7HEWADHN6P52R3QLIOX27U3DJ4HI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LM5V4VPLBHBEASSAROYPSHXGXGGPHNOE/","https://security.gentoo.org/glsa/202104-04","https://bugzilla.redhat.com/show_bug.cgi?id=1935913","https://www.oracle.com/security-alerts/cpuoct2021.html","https://security.netapp.com/advisory/ntap-20210629-0003/","https://www.oracle.com/security-alerts/cpujan2022.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","name":"[debian-lts-announce] 20210405 [SECURITY] [DLA 2619-1] python3.5 security update","tags":["mailing-list","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/25HVHLBGO2KNPXJ3G426QEYSSCECJDU5/","name":"FEDORA-2021-a311bf10d4","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VPX7Y5GQDNB4FJTREWONGC4ZSVH7TGHF/","name":"FEDORA-2021-2ab6f060d9","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DQYPUKLLBOZMKFPO7RD7CENTXHUUEUV7/","name":"FEDORA-2021-1769a23935","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/","name":"FEDORA-2021-b6b6093b3a","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QNGAFMPIYIVJ47FCF2NK2PIX22HUG35B/","name":"FEDORA-2021-067c9deff1","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BF2K7HEWADHN6P52R3QLIOX27U3DJ4HI/","name":"FEDORA-2021-0a8f3ffbc0","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LM5V4VPLBHBEASSAROYPSHXGXGGPHNOE/","name":"FEDORA-2021-a26257ccf5","tags":["vendor-advisory","x_transferred"]},{"url":"https://security.gentoo.org/glsa/202104-04","name":"GLSA-202104-04","tags":["vendor-advisory","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1935913","tags":["x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20210629-0003/","tags":["x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","name":"[debian-lts-announce] 20230630 [SECURITY] [DLA 3477-1] python3.7 security update","tags":["mailing-list","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T21:44:51.975Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.7,"attackVector":"ADJACENT_NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2021-3426","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2025-12-18T11:45:51.350788Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-12-18T11:45:56.551Z"}},{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"}],"x_adpType":"supplier","references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html"}],"providerMetadata":{"orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP","dateUpdated":"2026-10-14T09:49:37.022Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2023-06-30T00:00:00.000Z"}}},"related_cves":[{"value":"CVE-2021-3426","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:a4b2edba-fbe9-422c-9a18-35654ca08a13","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-3426","advisory_id":"a4b2edba-fbe9-422c-9a18-35654ca08a13","event_types":["advisory"],"published_at":"2026-10-25T05:48:12.447193+00:00","technologies":["core-cve","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-05-20T00:00:00+00:00","detail_url":"/events/21628"}]}},{"id":21716,"cve_ids":["CVE-2020-10735"],"payload":{"kind":"advisory","title":"CVE-2020-10735","summary":"A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int(\"text\"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability.","evidence":"cve:CVE-2020-10735","products":[{"name":{"value":"python","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-10735","aliases":["CVE-2020-10735"],"metrics":[],"affected":[{"vendor":"n/a","product":"python","versions":[{"status":"affected","version":"python 3.7"}]}],"modified":"2026-10-14T08:55:09.442Z","provider":"cve","references":["https://access.redhat.com/security/cve/CVE-2020-10735","https://github.com/python/cpython/issues/95778","https://docs.google.com/document/d/1KjuF_aXlzPUxTK4BMgezGJ2Pn7uevfX7g0_mvgHlL7Y","https://bugzilla.redhat.com/show_bug.cgi?id=1834423","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4EWKR2SPX3JORLWCXFY3KN2U5B5CIUQQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2VCU6EVQDIXNCEDJUCTFIER2WVNNDTYZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V7ZUJDHK7KNG6SLIFXW7MNZ6O2PUJYK6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSRPVJZL6DJFWKYRHMNJB7VCEUCBKRF5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6XL6E5A3I36TRR73VNBOXNIQP4AMZDFZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/32AAQKABEKFCB5DDV5OONRZK6BS23HPW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U4ZZV4CDFRMTPDBI7C5L43RFL3XLIGUY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SZYJSGLSCQOKXXFVJVJQAXLEOJBIWGEL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OT5WQB7Z3CXOWVBD2AFAHYPA5ONYFFZ4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBPDVCDIUCEBE7C4NAGNA2KQJYOTPBAZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OKYE2DOI2X7WZXAWTQJZAXYIWM37HDCY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OT5U223OE5ZOUHZAZYSYSWVJQIKDE73E/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PD7FTLJOIGMUSCDR3JAN6WRFHJEE4PH5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/76YE7AM37MRU76XJV4M27CWDAMUGNRYK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZEOAJWGGY55QU35UM2OVZATBW5MX2OZD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NHC6IUU7CLRQ3QLPWUXLONSG3SXFTR47/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TD7JDDKJXK6D26XAN3YRFNM2LAJHT5UO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXF6MQ74HVIDDSR5AE2UDR24I6D4FEPC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFGV7P2PYFBMK32OKHCAC2ZPJQV5AUDF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TMWPRAAJS7I6U3U45V7GZVXWNSECI22M/","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://access.redhat.com/security/cve/CVE-2020-10735","tags":["x_transferred"]},{"url":"https://github.com/python/cpython/issues/95778","tags":["x_transferred"]},{"url":"https://docs.google.com/document/d/1KjuF_aXlzPUxTK4BMgezGJ2Pn7uevfX7g0_mvgHlL7Y","tags":["x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1834423","tags":["x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4EWKR2SPX3JORLWCXFY3KN2U5B5CIUQQ/","name":"FEDORA-2022-46a44a7f83","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2VCU6EVQDIXNCEDJUCTFIER2WVNNDTYZ/","name":"FEDORA-2022-66b65beccb","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V7ZUJDHK7KNG6SLIFXW7MNZ6O2PUJYK6/","name":"FEDORA-2022-4b31e33ed0","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSRPVJZL6DJFWKYRHMNJB7VCEUCBKRF5/","name":"FEDORA-2022-6d57598a23","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6XL6E5A3I36TRR73VNBOXNIQP4AMZDFZ/","name":"FEDORA-2022-f330bbfda2","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/32AAQKABEKFCB5DDV5OONRZK6BS23HPW/","name":"FEDORA-2022-29d436596f","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U4ZZV4CDFRMTPDBI7C5L43RFL3XLIGUY/","name":"FEDORA-2022-b01214472e","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SZYJSGLSCQOKXXFVJVJQAXLEOJBIWGEL/","name":"FEDORA-2022-dd5032bedf","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OT5WQB7Z3CXOWVBD2AFAHYPA5ONYFFZ4/","name":"FEDORA-2022-8535093cba","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBPDVCDIUCEBE7C4NAGNA2KQJYOTPBAZ/","name":"FEDORA-2022-72213986b8","tags":["vendor-advisory","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2022/09/21/1","name":"[oss-security] 20220921 big ints in python: CVE-2020-10735","tags":["mailing-list","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2022/09/21/4","name":"[oss-security] 20220921 Re: big ints in python: CVE-2020-10735","tags":["mailing-list","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OKYE2DOI2X7WZXAWTQJZAXYIWM37HDCY/","name":"FEDORA-2022-f511f8f58b","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OT5U223OE5ZOUHZAZYSYSWVJQIKDE73E/","name":"FEDORA-2022-c072cdc3c8","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PD7FTLJOIGMUSCDR3JAN6WRFHJEE4PH5/","name":"FEDORA-2022-0b3904c674","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/76YE7AM37MRU76XJV4M27CWDAMUGNRYK/","name":"FEDORA-2022-141f632a6f","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZEOAJWGGY55QU35UM2OVZATBW5MX2OZD/","name":"FEDORA-2022-ac82a548df","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NHC6IUU7CLRQ3QLPWUXLONSG3SXFTR47/","name":"FEDORA-2022-d4570fc1a6","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TD7JDDKJXK6D26XAN3YRFNM2LAJHT5UO/","name":"FEDORA-2022-b8b34e62ab","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXF6MQ74HVIDDSR5AE2UDR24I6D4FEPC/","name":"FEDORA-2022-d1682fef04","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFGV7P2PYFBMK32OKHCAC2ZPJQV5AUDF/","name":"FEDORA-2022-79843dfb3c","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TMWPRAAJS7I6U3U45V7GZVXWNSECI22M/","name":"FEDORA-2022-958fd7a32e","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"},{"url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T21:44:16.139Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.2,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2020-10735","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-07T18:38:50.558859Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-704","description":"CWE-704 Incorrect Type Conversion or Cast"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-07T18:39:18.482Z"}},{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"}],"x_adpType":"supplier","references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-806742.html"}],"providerMetadata":{"orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP","dateUpdated":"2026-10-14T08:55:09.442Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2023-06-30T22:06:31.040Z"}}},"related_cves":[{"value":"CVE-2020-10735","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c72361e1-b90a-4e8f-aa9a-ccb05d92e18a","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2020-10735","advisory_id":"c72361e1-b90a-4e8f-aa9a-ccb05d92e18a","event_types":["advisory"],"published_at":"2026-10-25T05:47:33.080052+00:00","technologies":["core-cve","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2022-09-09T00:00:00+00:00","detail_url":"/advisories/advisory%3Ac72361e1-b90a-4e8f-aa9a-ccb05d92e18a","group":{"id":"advisory:c72361e1-b90a-4e8f-aa9a-ccb05d92e18a","revision":1,"primary_event_id":21564,"change":"published","superseded_by":[],"changed":{"id":21564,"cve_ids":["CVE-2020-10735"],"payload":{"kind":"advisory","title":"CVE-2020-10735","summary":"A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int(\"text\"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability.","evidence":"cve:CVE-2020-10735","products":[{"name":{"value":"python","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-10735","aliases":["CVE-2020-10735"],"metrics":[],"affected":[{"vendor":"n/a","product":"python","versions":[{"status":"affected","version":"python 3.7"}]}],"modified":"2026-10-14T08:55:09.442Z","provider":"cve","references":["https://access.redhat.com/security/cve/CVE-2020-10735","https://github.com/python/cpython/issues/95778","https://docs.google.com/document/d/1KjuF_aXlzPUxTK4BMgezGJ2Pn7uevfX7g0_mvgHlL7Y","https://bugzilla.redhat.com/show_bug.cgi?id=1834423","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4EWKR2SPX3JORLWCXFY3KN2U5B5CIUQQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2VCU6EVQDIXNCEDJUCTFIER2WVNNDTYZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V7ZUJDHK7KNG6SLIFXW7MNZ6O2PUJYK6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSRPVJZL6DJFWKYRHMNJB7VCEUCBKRF5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6XL6E5A3I36TRR73VNBOXNIQP4AMZDFZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/32AAQKABEKFCB5DDV5OONRZK6BS23HPW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U4ZZV4CDFRMTPDBI7C5L43RFL3XLIGUY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SZYJSGLSCQOKXXFVJVJQAXLEOJBIWGEL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OT5WQB7Z3CXOWVBD2AFAHYPA5ONYFFZ4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBPDVCDIUCEBE7C4NAGNA2KQJYOTPBAZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OKYE2DOI2X7WZXAWTQJZAXYIWM37HDCY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OT5U223OE5ZOUHZAZYSYSWVJQIKDE73E/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PD7FTLJOIGMUSCDR3JAN6WRFHJEE4PH5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/76YE7AM37MRU76XJV4M27CWDAMUGNRYK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZEOAJWGGY55QU35UM2OVZATBW5MX2OZD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NHC6IUU7CLRQ3QLPWUXLONSG3SXFTR47/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TD7JDDKJXK6D26XAN3YRFNM2LAJHT5UO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXF6MQ74HVIDDSR5AE2UDR24I6D4FEPC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFGV7P2PYFBMK32OKHCAC2ZPJQV5AUDF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TMWPRAAJS7I6U3U45V7GZVXWNSECI22M/","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://access.redhat.com/security/cve/CVE-2020-10735","tags":["x_transferred"]},{"url":"https://github.com/python/cpython/issues/95778","tags":["x_transferred"]},{"url":"https://docs.google.com/document/d/1KjuF_aXlzPUxTK4BMgezGJ2Pn7uevfX7g0_mvgHlL7Y","tags":["x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1834423","tags":["x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4EWKR2SPX3JORLWCXFY3KN2U5B5CIUQQ/","name":"FEDORA-2022-46a44a7f83","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2VCU6EVQDIXNCEDJUCTFIER2WVNNDTYZ/","name":"FEDORA-2022-66b65beccb","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V7ZUJDHK7KNG6SLIFXW7MNZ6O2PUJYK6/","name":"FEDORA-2022-4b31e33ed0","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSRPVJZL6DJFWKYRHMNJB7VCEUCBKRF5/","name":"FEDORA-2022-6d57598a23","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6XL6E5A3I36TRR73VNBOXNIQP4AMZDFZ/","name":"FEDORA-2022-f330bbfda2","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/32AAQKABEKFCB5DDV5OONRZK6BS23HPW/","name":"FEDORA-2022-29d436596f","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U4ZZV4CDFRMTPDBI7C5L43RFL3XLIGUY/","name":"FEDORA-2022-b01214472e","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SZYJSGLSCQOKXXFVJVJQAXLEOJBIWGEL/","name":"FEDORA-2022-dd5032bedf","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OT5WQB7Z3CXOWVBD2AFAHYPA5ONYFFZ4/","name":"FEDORA-2022-8535093cba","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBPDVCDIUCEBE7C4NAGNA2KQJYOTPBAZ/","name":"FEDORA-2022-72213986b8","tags":["vendor-advisory","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2022/09/21/1","name":"[oss-security] 20220921 big ints in python: CVE-2020-10735","tags":["mailing-list","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2022/09/21/4","name":"[oss-security] 20220921 Re: big ints in python: CVE-2020-10735","tags":["mailing-list","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OKYE2DOI2X7WZXAWTQJZAXYIWM37HDCY/","name":"FEDORA-2022-f511f8f58b","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OT5U223OE5ZOUHZAZYSYSWVJQIKDE73E/","name":"FEDORA-2022-c072cdc3c8","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PD7FTLJOIGMUSCDR3JAN6WRFHJEE4PH5/","name":"FEDORA-2022-0b3904c674","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/76YE7AM37MRU76XJV4M27CWDAMUGNRYK/","name":"FEDORA-2022-141f632a6f","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZEOAJWGGY55QU35UM2OVZATBW5MX2OZD/","name":"FEDORA-2022-ac82a548df","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NHC6IUU7CLRQ3QLPWUXLONSG3SXFTR47/","name":"FEDORA-2022-d4570fc1a6","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TD7JDDKJXK6D26XAN3YRFNM2LAJHT5UO/","name":"FEDORA-2022-b8b34e62ab","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXF6MQ74HVIDDSR5AE2UDR24I6D4FEPC/","name":"FEDORA-2022-d1682fef04","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFGV7P2PYFBMK32OKHCAC2ZPJQV5AUDF/","name":"FEDORA-2022-79843dfb3c","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TMWPRAAJS7I6U3U45V7GZVXWNSECI22M/","name":"FEDORA-2022-958fd7a32e","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"},{"url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T21:44:16.139Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.2,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2020-10735","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-07T18:38:50.558859Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-704","description":"CWE-704 Incorrect Type Conversion or Cast"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-07T18:39:18.482Z"}},{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"}],"x_adpType":"supplier","references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-806742.html"}],"providerMetadata":{"orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP","dateUpdated":"2026-10-14T08:55:09.442Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2023-06-30T22:06:31.040Z"}}},"related_cves":[{"value":"CVE-2020-10735","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c72361e1-b90a-4e8f-aa9a-ccb05d92e18a","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2020-10735","advisory_id":"c72361e1-b90a-4e8f-aa9a-ccb05d92e18a","event_types":["advisory"],"published_at":"2026-10-25T05:47:33.080052+00:00","technologies":["core-cve","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2022-09-09T00:00:00+00:00","detail_url":"/events/21564"},"members":[{"id":21564,"cve_ids":["CVE-2020-10735"],"payload":{"kind":"advisory","title":"CVE-2020-10735","summary":"A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int(\"text\"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability.","evidence":"cve:CVE-2020-10735","products":[{"name":{"value":"python","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-10735","aliases":["CVE-2020-10735"],"metrics":[],"affected":[{"vendor":"n/a","product":"python","versions":[{"status":"affected","version":"python 3.7"}]}],"modified":"2026-10-14T08:55:09.442Z","provider":"cve","references":["https://access.redhat.com/security/cve/CVE-2020-10735","https://github.com/python/cpython/issues/95778","https://docs.google.com/document/d/1KjuF_aXlzPUxTK4BMgezGJ2Pn7uevfX7g0_mvgHlL7Y","https://bugzilla.redhat.com/show_bug.cgi?id=1834423","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4EWKR2SPX3JORLWCXFY3KN2U5B5CIUQQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2VCU6EVQDIXNCEDJUCTFIER2WVNNDTYZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V7ZUJDHK7KNG6SLIFXW7MNZ6O2PUJYK6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSRPVJZL6DJFWKYRHMNJB7VCEUCBKRF5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6XL6E5A3I36TRR73VNBOXNIQP4AMZDFZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/32AAQKABEKFCB5DDV5OONRZK6BS23HPW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U4ZZV4CDFRMTPDBI7C5L43RFL3XLIGUY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SZYJSGLSCQOKXXFVJVJQAXLEOJBIWGEL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OT5WQB7Z3CXOWVBD2AFAHYPA5ONYFFZ4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBPDVCDIUCEBE7C4NAGNA2KQJYOTPBAZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OKYE2DOI2X7WZXAWTQJZAXYIWM37HDCY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OT5U223OE5ZOUHZAZYSYSWVJQIKDE73E/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PD7FTLJOIGMUSCDR3JAN6WRFHJEE4PH5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/76YE7AM37MRU76XJV4M27CWDAMUGNRYK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZEOAJWGGY55QU35UM2OVZATBW5MX2OZD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NHC6IUU7CLRQ3QLPWUXLONSG3SXFTR47/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TD7JDDKJXK6D26XAN3YRFNM2LAJHT5UO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXF6MQ74HVIDDSR5AE2UDR24I6D4FEPC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFGV7P2PYFBMK32OKHCAC2ZPJQV5AUDF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TMWPRAAJS7I6U3U45V7GZVXWNSECI22M/","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://access.redhat.com/security/cve/CVE-2020-10735","tags":["x_transferred"]},{"url":"https://github.com/python/cpython/issues/95778","tags":["x_transferred"]},{"url":"https://docs.google.com/document/d/1KjuF_aXlzPUxTK4BMgezGJ2Pn7uevfX7g0_mvgHlL7Y","tags":["x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1834423","tags":["x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4EWKR2SPX3JORLWCXFY3KN2U5B5CIUQQ/","name":"FEDORA-2022-46a44a7f83","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2VCU6EVQDIXNCEDJUCTFIER2WVNNDTYZ/","name":"FEDORA-2022-66b65beccb","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V7ZUJDHK7KNG6SLIFXW7MNZ6O2PUJYK6/","name":"FEDORA-2022-4b31e33ed0","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSRPVJZL6DJFWKYRHMNJB7VCEUCBKRF5/","name":"FEDORA-2022-6d57598a23","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6XL6E5A3I36TRR73VNBOXNIQP4AMZDFZ/","name":"FEDORA-2022-f330bbfda2","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/32AAQKABEKFCB5DDV5OONRZK6BS23HPW/","name":"FEDORA-2022-29d436596f","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U4ZZV4CDFRMTPDBI7C5L43RFL3XLIGUY/","name":"FEDORA-2022-b01214472e","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SZYJSGLSCQOKXXFVJVJQAXLEOJBIWGEL/","name":"FEDORA-2022-dd5032bedf","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OT5WQB7Z3CXOWVBD2AFAHYPA5ONYFFZ4/","name":"FEDORA-2022-8535093cba","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBPDVCDIUCEBE7C4NAGNA2KQJYOTPBAZ/","name":"FEDORA-2022-72213986b8","tags":["vendor-advisory","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2022/09/21/1","name":"[oss-security] 20220921 big ints in python: CVE-2020-10735","tags":["mailing-list","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2022/09/21/4","name":"[oss-security] 20220921 Re: big ints in python: CVE-2020-10735","tags":["mailing-list","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OKYE2DOI2X7WZXAWTQJZAXYIWM37HDCY/","name":"FEDORA-2022-f511f8f58b","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OT5U223OE5ZOUHZAZYSYSWVJQIKDE73E/","name":"FEDORA-2022-c072cdc3c8","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PD7FTLJOIGMUSCDR3JAN6WRFHJEE4PH5/","name":"FEDORA-2022-0b3904c674","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/76YE7AM37MRU76XJV4M27CWDAMUGNRYK/","name":"FEDORA-2022-141f632a6f","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZEOAJWGGY55QU35UM2OVZATBW5MX2OZD/","name":"FEDORA-2022-ac82a548df","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NHC6IUU7CLRQ3QLPWUXLONSG3SXFTR47/","name":"FEDORA-2022-d4570fc1a6","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TD7JDDKJXK6D26XAN3YRFNM2LAJHT5UO/","name":"FEDORA-2022-b8b34e62ab","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXF6MQ74HVIDDSR5AE2UDR24I6D4FEPC/","name":"FEDORA-2022-d1682fef04","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFGV7P2PYFBMK32OKHCAC2ZPJQV5AUDF/","name":"FEDORA-2022-79843dfb3c","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TMWPRAAJS7I6U3U45V7GZVXWNSECI22M/","name":"FEDORA-2022-958fd7a32e","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"},{"url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T21:44:16.139Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.2,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2020-10735","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-07T18:38:50.558859Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-704","description":"CWE-704 Incorrect Type Conversion or Cast"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-07T18:39:18.482Z"}},{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"}],"x_adpType":"supplier","references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-806742.html"}],"providerMetadata":{"orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP","dateUpdated":"2026-10-14T08:55:09.442Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2023-06-30T22:06:31.040Z"}}},"related_cves":[{"value":"CVE-2020-10735","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c72361e1-b90a-4e8f-aa9a-ccb05d92e18a","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2020-10735","advisory_id":"c72361e1-b90a-4e8f-aa9a-ccb05d92e18a","event_types":["advisory"],"published_at":"2026-10-25T05:47:33.080052+00:00","technologies":["core-cve","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2022-09-09T00:00:00+00:00","detail_url":"/events/21564"}]}},{"id":21620,"cve_ids":["CVE-2019-10160"],"payload":{"kind":"advisory","title":"CVE-2019-10160","summary":"A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application.","evidence":"cve:CVE-2019-10160","products":[{"name":{"value":"python","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2019-10160","aliases":["CVE-2019-10160"],"metrics":[{"cvssV3_0":{"scope":"UNCHANGED","version":"3.0","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"Python","product":"python","versions":[{"status":"affected","version":"affects 2.7, 3.5, 3.6, 3.7, >= v3.8.0a4 and < v3.8.0b1"}]}],"modified":"2026-10-14T06:49:52.193Z","provider":"cve","references":["https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization2.html","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10160","https://github.com/python/cpython/commit/8d0ef0b5edeae52960c7ed05ae8a12388324f87e","https://github.com/python/cpython/commit/f61599b050c621386a3fc6bc480359e2d3bb93de","https://github.com/python/cpython/commit/250b62acc59921d399f0db47db3b462cd6037e09","https://github.com/python/cpython/commit/fd1771dbdd28709716bd531580c40ae5ed814468","https://security.netapp.com/advisory/ntap-20190617-0003/","https://access.redhat.com/errata/RHSA-2019:1587","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://access.redhat.com/errata/RHSA-2019:1700","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/","https://access.redhat.com/errata/RHSA-2019:2437","https://usn.ubuntu.com/4127-2/","https://usn.ubuntu.com/4127-1/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NF3DRDGMVIRYNZMSLJIHNW47HOUQYXVG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization2.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10160","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://github.com/python/cpython/commit/8d0ef0b5edeae52960c7ed05ae8a12388324f87e","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://github.com/python/cpython/commit/f61599b050c621386a3fc6bc480359e2d3bb93de","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://github.com/python/cpython/commit/250b62acc59921d399f0db47db3b462cd6037e09","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://github.com/python/cpython/commit/fd1771dbdd28709716bd531580c40ae5ed814468","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20190617-0003/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1587","name":"RHSA-2019:1587","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","name":"[debian-lts-announce] 20190625 [SECURITY] [DLA 1834-1] python2.7 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1700","name":"RHSA-2019:1700","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/","name":"FEDORA-2019-7723d4774a","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/","name":"FEDORA-2019-7df59302e0","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/","name":"FEDORA-2019-9bfb4a3e4b","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/","name":"FEDORA-2019-60a1defcd1","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2437","name":"RHSA-2019:2437","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00042.html","name":"openSUSE-SU-2019:1906","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://usn.ubuntu.com/4127-2/","name":"USN-4127-2","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"https://usn.ubuntu.com/4127-1/","name":"USN-4127-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NF3DRDGMVIRYNZMSLJIHNW47HOUQYXVG/","name":"FEDORA-2019-50772cf122","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/","name":"FEDORA-2019-5dc275c9f2","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/","name":"FEDORA-2019-2b1f72899a","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","name":"FEDORA-2019-b06ec6159b","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","name":"FEDORA-2019-d202cda4f8","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","name":"FEDORA-2019-57462fa10d","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","name":"openSUSE-SU-2020:0086","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","name":"[debian-lts-announce] 20200715 [SECURITY] [DLA 2280-1] python3.5 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","name":"[bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","name":"[debian-lts-announce] 20200822 [SECURITY] [DLA 2337-1] python2.7 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-04T22:10:10.028Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2019-10160","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-07T18:23:24.180971Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-07T18:23:41.019Z"}},{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"}],"x_adpType":"supplier","references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html"}],"providerMetadata":{"orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP","dateUpdated":"2026-10-14T06:49:52.193Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2020-08-22T16:06:12.000Z"}}},"related_cves":[{"value":"CVE-2019-10160","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:b48eccfb-f7d2-499c-a70c-04072c1853d5","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2019-10160","advisory_id":"b48eccfb-f7d2-499c-a70c-04072c1853d5","event_types":["advisory"],"published_at":"2026-10-25T05:45:31.211052+00:00","technologies":["core-cve","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2019-06-07T17:50:33+00:00","detail_url":"/advisories/advisory%3Ab48eccfb-f7d2-499c-a70c-04072c1853d5","group":{"id":"advisory:b48eccfb-f7d2-499c-a70c-04072c1853d5","revision":1,"primary_event_id":21470,"change":"published","superseded_by":[],"changed":{"id":21470,"cve_ids":["CVE-2019-10160"],"payload":{"kind":"advisory","title":"CVE-2019-10160","summary":"A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application.","evidence":"cve:CVE-2019-10160","products":[{"name":{"value":"python","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2019-10160","aliases":["CVE-2019-10160"],"metrics":[{"cvssV3_0":{"scope":"UNCHANGED","version":"3.0","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"Python","product":"python","versions":[{"status":"affected","version":"affects 2.7, 3.5, 3.6, 3.7, >= v3.8.0a4 and < v3.8.0b1"}]}],"modified":"2026-10-14T06:49:52.193Z","provider":"cve","references":["https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization2.html","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10160","https://github.com/python/cpython/commit/8d0ef0b5edeae52960c7ed05ae8a12388324f87e","https://github.com/python/cpython/commit/f61599b050c621386a3fc6bc480359e2d3bb93de","https://github.com/python/cpython/commit/250b62acc59921d399f0db47db3b462cd6037e09","https://github.com/python/cpython/commit/fd1771dbdd28709716bd531580c40ae5ed814468","https://security.netapp.com/advisory/ntap-20190617-0003/","https://access.redhat.com/errata/RHSA-2019:1587","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://access.redhat.com/errata/RHSA-2019:1700","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/","https://access.redhat.com/errata/RHSA-2019:2437","https://usn.ubuntu.com/4127-2/","https://usn.ubuntu.com/4127-1/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NF3DRDGMVIRYNZMSLJIHNW47HOUQYXVG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization2.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10160","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://github.com/python/cpython/commit/8d0ef0b5edeae52960c7ed05ae8a12388324f87e","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://github.com/python/cpython/commit/f61599b050c621386a3fc6bc480359e2d3bb93de","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://github.com/python/cpython/commit/250b62acc59921d399f0db47db3b462cd6037e09","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://github.com/python/cpython/commit/fd1771dbdd28709716bd531580c40ae5ed814468","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20190617-0003/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1587","name":"RHSA-2019:1587","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","name":"[debian-lts-announce] 20190625 [SECURITY] [DLA 1834-1] python2.7 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1700","name":"RHSA-2019:1700","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/","name":"FEDORA-2019-7723d4774a","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/","name":"FEDORA-2019-7df59302e0","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/","name":"FEDORA-2019-9bfb4a3e4b","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/","name":"FEDORA-2019-60a1defcd1","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2437","name":"RHSA-2019:2437","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00042.html","name":"openSUSE-SU-2019:1906","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://usn.ubuntu.com/4127-2/","name":"USN-4127-2","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"https://usn.ubuntu.com/4127-1/","name":"USN-4127-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NF3DRDGMVIRYNZMSLJIHNW47HOUQYXVG/","name":"FEDORA-2019-50772cf122","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/","name":"FEDORA-2019-5dc275c9f2","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/","name":"FEDORA-2019-2b1f72899a","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","name":"FEDORA-2019-b06ec6159b","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","name":"FEDORA-2019-d202cda4f8","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","name":"FEDORA-2019-57462fa10d","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","name":"openSUSE-SU-2020:0086","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","name":"[debian-lts-announce] 20200715 [SECURITY] [DLA 2280-1] python3.5 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","name":"[bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","name":"[debian-lts-announce] 20200822 [SECURITY] [DLA 2337-1] python2.7 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-04T22:10:10.028Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2019-10160","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-07T18:23:24.180971Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-07T18:23:41.019Z"}},{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"}],"x_adpType":"supplier","references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html"}],"providerMetadata":{"orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP","dateUpdated":"2026-10-14T06:49:52.193Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2020-08-22T16:06:12.000Z"}}},"related_cves":[{"value":"CVE-2019-10160","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:b48eccfb-f7d2-499c-a70c-04072c1853d5","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2019-10160","advisory_id":"b48eccfb-f7d2-499c-a70c-04072c1853d5","event_types":["advisory"],"published_at":"2026-10-25T05:45:31.211052+00:00","technologies":["core-cve","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2019-06-07T17:50:33+00:00","detail_url":"/events/21470"},"members":[{"id":21470,"cve_ids":["CVE-2019-10160"],"payload":{"kind":"advisory","title":"CVE-2019-10160","summary":"A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application.","evidence":"cve:CVE-2019-10160","products":[{"name":{"value":"python","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2019-10160","aliases":["CVE-2019-10160"],"metrics":[{"cvssV3_0":{"scope":"UNCHANGED","version":"3.0","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"Python","product":"python","versions":[{"status":"affected","version":"affects 2.7, 3.5, 3.6, 3.7, >= v3.8.0a4 and < v3.8.0b1"}]}],"modified":"2026-10-14T06:49:52.193Z","provider":"cve","references":["https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization2.html","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10160","https://github.com/python/cpython/commit/8d0ef0b5edeae52960c7ed05ae8a12388324f87e","https://github.com/python/cpython/commit/f61599b050c621386a3fc6bc480359e2d3bb93de","https://github.com/python/cpython/commit/250b62acc59921d399f0db47db3b462cd6037e09","https://github.com/python/cpython/commit/fd1771dbdd28709716bd531580c40ae5ed814468","https://security.netapp.com/advisory/ntap-20190617-0003/","https://access.redhat.com/errata/RHSA-2019:1587","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://access.redhat.com/errata/RHSA-2019:1700","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/","https://access.redhat.com/errata/RHSA-2019:2437","https://usn.ubuntu.com/4127-2/","https://usn.ubuntu.com/4127-1/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NF3DRDGMVIRYNZMSLJIHNW47HOUQYXVG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization2.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10160","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://github.com/python/cpython/commit/8d0ef0b5edeae52960c7ed05ae8a12388324f87e","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://github.com/python/cpython/commit/f61599b050c621386a3fc6bc480359e2d3bb93de","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://github.com/python/cpython/commit/250b62acc59921d399f0db47db3b462cd6037e09","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://github.com/python/cpython/commit/fd1771dbdd28709716bd531580c40ae5ed814468","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20190617-0003/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1587","name":"RHSA-2019:1587","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","name":"[debian-lts-announce] 20190625 [SECURITY] [DLA 1834-1] python2.7 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1700","name":"RHSA-2019:1700","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/","name":"FEDORA-2019-7723d4774a","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/","name":"FEDORA-2019-7df59302e0","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/","name":"FEDORA-2019-9bfb4a3e4b","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/","name":"FEDORA-2019-60a1defcd1","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2437","name":"RHSA-2019:2437","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00042.html","name":"openSUSE-SU-2019:1906","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://usn.ubuntu.com/4127-2/","name":"USN-4127-2","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"https://usn.ubuntu.com/4127-1/","name":"USN-4127-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NF3DRDGMVIRYNZMSLJIHNW47HOUQYXVG/","name":"FEDORA-2019-50772cf122","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/","name":"FEDORA-2019-5dc275c9f2","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/","name":"FEDORA-2019-2b1f72899a","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","name":"FEDORA-2019-b06ec6159b","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","name":"FEDORA-2019-d202cda4f8","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","name":"FEDORA-2019-57462fa10d","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","name":"openSUSE-SU-2020:0086","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","name":"[debian-lts-announce] 20200715 [SECURITY] [DLA 2280-1] python3.5 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","name":"[bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","name":"[debian-lts-announce] 20200822 [SECURITY] [DLA 2337-1] python2.7 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-04T22:10:10.028Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2019-10160","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-07T18:23:24.180971Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-07T18:23:41.019Z"}},{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"}],"x_adpType":"supplier","references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html"}],"providerMetadata":{"orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP","dateUpdated":"2026-10-14T06:49:52.193Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2020-08-22T16:06:12.000Z"}}},"related_cves":[{"value":"CVE-2019-10160","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:b48eccfb-f7d2-499c-a70c-04072c1853d5","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2019-10160","advisory_id":"b48eccfb-f7d2-499c-a70c-04072c1853d5","event_types":["advisory"],"published_at":"2026-10-25T05:45:31.211052+00:00","technologies":["core-cve","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2019-06-07T17:50:33+00:00","detail_url":"/events/21470"}]}},{"id":21469,"cve_ids":["CVE-2026-18503"],"payload":{"kind":"advisory","title":"Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()","summary":"Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().","evidence":"cve:CVE-2026-18503","products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-18503","aliases":["CVE-2026-18503"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":2.4,"Automatable":"NOT_DEFINED","attackVector":"LOCAL","baseSeverity":"LOW","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/python/cpython","vendor":"Python Software Foundation","modules":["csv"],"product":"CPython","versions":[{"status":"affected","version":"0","lessThan":"3.10.21","versionType":"python"},{"status":"affected","version":"3.11.0","lessThan":"3.11.16","versionType":"python"},{"status":"affected","version":"3.12.0","lessThan":"3.12.14","versionType":"python"},{"status":"affected","version":"3.13.0","lessThan":"3.13.15","versionType":"python"},{"status":"affected","version":"3.14.0","lessThan":"3.14.7","versionType":"python"},{"status":"affected","version":"3.15.0a1","lessThan":"3.15.0rc1","versionType":"python"},{"status":"affected","version":"3.16.0a1","lessThan":"3.16.0","versionType":"python"}],"defaultStatus":"unaffected"}],"modified":"2026-10-14T00:34:46.583Z","provider":"cve","references":["https://mail.python.org/archives/list/security-announce@python.org/thread/KQ7NBMCPAZJHRROQXJQE4GMXGLD5KHBS/","https://github.com/python/cpython/pull/153694","https://github.com/python/cpython/issues/98820","https://github.com/python/cpython/commit/063d4555c94ef412c731527dbf30193327f2ee82","https://github.com/python/cpython/commit/476fb09cdb0d73e645849d98c610e7e5697ce7c9","https://github.com/python/cpython/commit/89f29c760c02774b099ddd6863268eb13fa3946a","https://github.com/python/cpython/commit/b30c7fa9edd921a118f286e9f90f560777fa693b","https://github.com/python/cpython/commit/b09a67a20c464f8288c9f9a6b9c7082a74560024","https://github.com/python/cpython/commit/fd78b565d7c326f96ae903ab945b47f35d829cf4"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-18503","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-08-10T17:56:17.853221Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-10T17:56:28.336Z"}}],"cna":{"orgId":"28c92f92-d60d-412d-b760-e73465c3df22","shortName":"PSF","dateUpdated":"2026-10-14T00:34:46.583Z"}}},"related_cves":[{"value":"CVE-2026-18503","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ab73215c-de5c-4fc7-978a-b71ab8a41b49","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-18503","advisory_id":"ab73215c-de5c-4fc7-978a-b71ab8a41b49","event_types":["advisory"],"published_at":"2026-10-25T05:43:04.096405+00:00","technologies":["core-cve","cpython"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-10T13:45:31.618+00:00","detail_url":"/advisories/advisory%3Aab73215c-de5c-4fc7-978a-b71ab8a41b49","group":{"id":"advisory:ab73215c-de5c-4fc7-978a-b71ab8a41b49","revision":1,"primary_event_id":21320,"change":"published","superseded_by":[],"changed":{"id":21320,"cve_ids":["CVE-2026-18503"],"payload":{"kind":"advisory","title":"Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()","summary":"Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().","evidence":"cve:CVE-2026-18503","products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-18503","aliases":["CVE-2026-18503"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":2.4,"Automatable":"NOT_DEFINED","attackVector":"LOCAL","baseSeverity":"LOW","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/python/cpython","vendor":"Python Software Foundation","modules":["csv"],"product":"CPython","versions":[{"status":"affected","version":"0","lessThan":"3.10.21","versionType":"python"},{"status":"affected","version":"3.11.0","lessThan":"3.11.16","versionType":"python"},{"status":"affected","version":"3.12.0","lessThan":"3.12.14","versionType":"python"},{"status":"affected","version":"3.13.0","lessThan":"3.13.15","versionType":"python"},{"status":"affected","version":"3.14.0","lessThan":"3.14.7","versionType":"python"},{"status":"affected","version":"3.15.0a1","lessThan":"3.15.0rc1","versionType":"python"},{"status":"affected","version":"3.16.0a1","lessThan":"3.16.0","versionType":"python"}],"defaultStatus":"unaffected"}],"modified":"2026-10-14T00:34:46.583Z","provider":"cve","references":["https://mail.python.org/archives/list/security-announce@python.org/thread/KQ7NBMCPAZJHRROQXJQE4GMXGLD5KHBS/","https://github.com/python/cpython/pull/153694","https://github.com/python/cpython/issues/98820","https://github.com/python/cpython/commit/063d4555c94ef412c731527dbf30193327f2ee82","https://github.com/python/cpython/commit/476fb09cdb0d73e645849d98c610e7e5697ce7c9","https://github.com/python/cpython/commit/89f29c760c02774b099ddd6863268eb13fa3946a","https://github.com/python/cpython/commit/b30c7fa9edd921a118f286e9f90f560777fa693b","https://github.com/python/cpython/commit/b09a67a20c464f8288c9f9a6b9c7082a74560024","https://github.com/python/cpython/commit/fd78b565d7c326f96ae903ab945b47f35d829cf4"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-18503","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-08-10T17:56:17.853221Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-10T17:56:28.336Z"}}],"cna":{"orgId":"28c92f92-d60d-412d-b760-e73465c3df22","shortName":"PSF","dateUpdated":"2026-10-14T00:34:46.583Z"}}},"related_cves":[{"value":"CVE-2026-18503","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ab73215c-de5c-4fc7-978a-b71ab8a41b49","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-18503","advisory_id":"ab73215c-de5c-4fc7-978a-b71ab8a41b49","event_types":["advisory"],"published_at":"2026-10-25T05:43:04.096405+00:00","technologies":["core-cve","cpython"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-10T13:45:31.618+00:00","detail_url":"/events/21320"},"members":[{"id":21320,"cve_ids":["CVE-2026-18503"],"payload":{"kind":"advisory","title":"Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()","summary":"Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().","evidence":"cve:CVE-2026-18503","products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-18503","aliases":["CVE-2026-18503"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":2.4,"Automatable":"NOT_DEFINED","attackVector":"LOCAL","baseSeverity":"LOW","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/python/cpython","vendor":"Python Software Foundation","modules":["csv"],"product":"CPython","versions":[{"status":"affected","version":"0","lessThan":"3.10.21","versionType":"python"},{"status":"affected","version":"3.11.0","lessThan":"3.11.16","versionType":"python"},{"status":"affected","version":"3.12.0","lessThan":"3.12.14","versionType":"python"},{"status":"affected","version":"3.13.0","lessThan":"3.13.15","versionType":"python"},{"status":"affected","version":"3.14.0","lessThan":"3.14.7","versionType":"python"},{"status":"affected","version":"3.15.0a1","lessThan":"3.15.0rc1","versionType":"python"},{"status":"affected","version":"3.16.0a1","lessThan":"3.16.0","versionType":"python"}],"defaultStatus":"unaffected"}],"modified":"2026-10-14T00:34:46.583Z","provider":"cve","references":["https://mail.python.org/archives/list/security-announce@python.org/thread/KQ7NBMCPAZJHRROQXJQE4GMXGLD5KHBS/","https://github.com/python/cpython/pull/153694","https://github.com/python/cpython/issues/98820","https://github.com/python/cpython/commit/063d4555c94ef412c731527dbf30193327f2ee82","https://github.com/python/cpython/commit/476fb09cdb0d73e645849d98c610e7e5697ce7c9","https://github.com/python/cpython/commit/89f29c760c02774b099ddd6863268eb13fa3946a","https://github.com/python/cpython/commit/b30c7fa9edd921a118f286e9f90f560777fa693b","https://github.com/python/cpython/commit/b09a67a20c464f8288c9f9a6b9c7082a74560024","https://github.com/python/cpython/commit/fd78b565d7c326f96ae903ab945b47f35d829cf4"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-18503","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-08-10T17:56:17.853221Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-10T17:56:28.336Z"}}],"cna":{"orgId":"28c92f92-d60d-412d-b760-e73465c3df22","shortName":"PSF","dateUpdated":"2026-10-14T00:34:46.583Z"}}},"related_cves":[{"value":"CVE-2026-18503","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ab73215c-de5c-4fc7-978a-b71ab8a41b49","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-18503","advisory_id":"ab73215c-de5c-4fc7-978a-b71ab8a41b49","event_types":["advisory"],"published_at":"2026-10-25T05:43:04.096405+00:00","technologies":["core-cve","cpython"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-10T13:45:31.618+00:00","detail_url":"/events/21320"}]}},{"id":16740,"cve_ids":["CVE-2026-82049"],"payload":{"kind":"advisory","title":"tarfile extraction filters allow file modification and content disclosure via hard link to symlink","summary":"In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.","evidence":"cve:CVE-2026-82049","products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-82049","aliases":["CVE-2026-82049"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":8.4,"Automatable":"NOT_DEFINED","attackVector":"LOCAL","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/python/cpython","vendor":"Python Software Foundation","modules":["tarfile"],"product":"CPython","versions":[{"status":"affected","version":"0","lessThan":"3.10.22","versionType":"python"},{"status":"affected","version":"3.11.0","lessThan":"3.11.17","versionType":"python"},{"status":"affected","version":"3.12.0","lessThan":"3.12.15","versionType":"python"},{"status":"affected","version":"3.13.0","lessThan":"3.13.16","versionType":"python"},{"status":"affected","version":"3.14.0a1","lessThan":"3.14.0b1","versionType":"python"}],"defaultStatus":"unaffected"}],"modified":"2026-10-11T00:39:42.376Z","provider":"cve","references":["https://github.com/python/cpython/commit/5a57248b22ad3b9aafcaaadae2c304a1923daeca","https://github.com/python/cpython/issues/157190","https://github.com/python/cpython/pull/157191","https://mail.python.org/archives/list/security-announce@python.org/thread/EFJWGAZJA56AKSBR2WHMHQZO7RRLZPRH/","https://github.com/python/cpython/commit/b38be2e6cf9d989075ab73412c63e003ebad4ff3","https://github.com/python/cpython/commit/b8f23e307097552eaea2604383a12ab280520d0d","https://github.com/python/cpython/commit/197663d63afed27f66e10e23c194e8a634e60913","https://github.com/python/cpython/commit/28f315486b3da0352b9a1de1c3c97f4127ba4771","https://github.com/python/cpython/commit/c66df4e70435d257fd488b35ea129c6f317433a8","https://github.com/python/cpython/commit/cc1689830c6b9aaddded2fb9f2fe8116867e2c0e","https://github.com/python/cpython/commit/cccc7ec30212dba2abef53ce4a2bed112ddb690c"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-82049","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-15T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-16T03:56:12.084Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/09/14/27"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-09-14T20:07:50.158Z"}}],"cna":{"orgId":"28c92f92-d60d-412d-b760-e73465c3df22","shortName":"PSF","dateUpdated":"2026-10-11T00:39:42.376Z"}}},"related_cves":[{"value":"CVE-2026-82049","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:df608c70-045a-48c9-8a5f-85b628864430","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-82049","advisory_id":"df608c70-045a-48c9-8a5f-85b628864430","event_types":["advisory"],"published_at":"2026-10-25T01:19:54.61154+00:00","technologies":["core-cve","cpython"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-14T19:14:03.873+00:00","detail_url":"/advisories/advisory%3Adf608c70-045a-48c9-8a5f-85b628864430","group":{"id":"advisory:df608c70-045a-48c9-8a5f-85b628864430","revision":1,"primary_event_id":16636,"change":"published","superseded_by":[],"changed":{"id":16636,"cve_ids":["CVE-2026-82049"],"payload":{"kind":"advisory","title":"tarfile extraction filters allow file modification and content disclosure via hard link to symlink","summary":"In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.","evidence":"cve:CVE-2026-82049","products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-82049","aliases":["CVE-2026-82049"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":8.4,"Automatable":"NOT_DEFINED","attackVector":"LOCAL","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/python/cpython","vendor":"Python Software Foundation","modules":["tarfile"],"product":"CPython","versions":[{"status":"affected","version":"0","lessThan":"3.10.22","versionType":"python"},{"status":"affected","version":"3.11.0","lessThan":"3.11.17","versionType":"python"},{"status":"affected","version":"3.12.0","lessThan":"3.12.15","versionType":"python"},{"status":"affected","version":"3.13.0","lessThan":"3.13.16","versionType":"python"},{"status":"affected","version":"3.14.0a1","lessThan":"3.14.0b1","versionType":"python"}],"defaultStatus":"unaffected"}],"modified":"2026-10-11T00:39:42.376Z","provider":"cve","references":["https://github.com/python/cpython/commit/5a57248b22ad3b9aafcaaadae2c304a1923daeca","https://github.com/python/cpython/issues/157190","https://github.com/python/cpython/pull/157191","https://mail.python.org/archives/list/security-announce@python.org/thread/EFJWGAZJA56AKSBR2WHMHQZO7RRLZPRH/","https://github.com/python/cpython/commit/b38be2e6cf9d989075ab73412c63e003ebad4ff3","https://github.com/python/cpython/commit/b8f23e307097552eaea2604383a12ab280520d0d","https://github.com/python/cpython/commit/197663d63afed27f66e10e23c194e8a634e60913","https://github.com/python/cpython/commit/28f315486b3da0352b9a1de1c3c97f4127ba4771","https://github.com/python/cpython/commit/c66df4e70435d257fd488b35ea129c6f317433a8","https://github.com/python/cpython/commit/cc1689830c6b9aaddded2fb9f2fe8116867e2c0e","https://github.com/python/cpython/commit/cccc7ec30212dba2abef53ce4a2bed112ddb690c"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-82049","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-15T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-16T03:56:12.084Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/09/14/27"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-09-14T20:07:50.158Z"}}],"cna":{"orgId":"28c92f92-d60d-412d-b760-e73465c3df22","shortName":"PSF","dateUpdated":"2026-10-11T00:39:42.376Z"}}},"related_cves":[{"value":"CVE-2026-82049","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:df608c70-045a-48c9-8a5f-85b628864430","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-82049","advisory_id":"df608c70-045a-48c9-8a5f-85b628864430","event_types":["advisory"],"published_at":"2026-10-25T01:19:54.61154+00:00","technologies":["core-cve","cpython"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-14T19:14:03.873+00:00","detail_url":"/events/16636"},"members":[{"id":16636,"cve_ids":["CVE-2026-82049"],"payload":{"kind":"advisory","title":"tarfile extraction filters allow file modification and content disclosure via hard link to symlink","summary":"In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.","evidence":"cve:CVE-2026-82049","products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-82049","aliases":["CVE-2026-82049"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":8.4,"Automatable":"NOT_DEFINED","attackVector":"LOCAL","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/python/cpython","vendor":"Python Software Foundation","modules":["tarfile"],"product":"CPython","versions":[{"status":"affected","version":"0","lessThan":"3.10.22","versionType":"python"},{"status":"affected","version":"3.11.0","lessThan":"3.11.17","versionType":"python"},{"status":"affected","version":"3.12.0","lessThan":"3.12.15","versionType":"python"},{"status":"affected","version":"3.13.0","lessThan":"3.13.16","versionType":"python"},{"status":"affected","version":"3.14.0a1","lessThan":"3.14.0b1","versionType":"python"}],"defaultStatus":"unaffected"}],"modified":"2026-10-11T00:39:42.376Z","provider":"cve","references":["https://github.com/python/cpython/commit/5a57248b22ad3b9aafcaaadae2c304a1923daeca","https://github.com/python/cpython/issues/157190","https://github.com/python/cpython/pull/157191","https://mail.python.org/archives/list/security-announce@python.org/thread/EFJWGAZJA56AKSBR2WHMHQZO7RRLZPRH/","https://github.com/python/cpython/commit/b38be2e6cf9d989075ab73412c63e003ebad4ff3","https://github.com/python/cpython/commit/b8f23e307097552eaea2604383a12ab280520d0d","https://github.com/python/cpython/commit/197663d63afed27f66e10e23c194e8a634e60913","https://github.com/python/cpython/commit/28f315486b3da0352b9a1de1c3c97f4127ba4771","https://github.com/python/cpython/commit/c66df4e70435d257fd488b35ea129c6f317433a8","https://github.com/python/cpython/commit/cc1689830c6b9aaddded2fb9f2fe8116867e2c0e","https://github.com/python/cpython/commit/cccc7ec30212dba2abef53ce4a2bed112ddb690c"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-82049","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-15T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-16T03:56:12.084Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/09/14/27"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-09-14T20:07:50.158Z"}}],"cna":{"orgId":"28c92f92-d60d-412d-b760-e73465c3df22","shortName":"PSF","dateUpdated":"2026-10-11T00:39:42.376Z"}}},"related_cves":[{"value":"CVE-2026-82049","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:df608c70-045a-48c9-8a5f-85b628864430","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-82049","advisory_id":"df608c70-045a-48c9-8a5f-85b628864430","event_types":["advisory"],"published_at":"2026-10-25T01:19:54.61154+00:00","technologies":["core-cve","cpython"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-14T19:14:03.873+00:00","detail_url":"/events/16636"}]}},{"id":15840,"cve_ids":["CVE-2018-1060"],"payload":{"kind":"advisory","title":"CVE-2018-1060","summary":"python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.","evidence":"cve:CVE-2018-1060","products":[{"name":{"value":"python","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2018-1060","aliases":["CVE-2018-1060"],"metrics":[{"cvssV3_0":{"scope":"UNCHANGED","version":"3.0","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"[UNKNOWN]","product":"python","versions":[{"status":"affected","version":"python 2.7.15"},{"status":"affected","version":"python 3.4.9"},{"status":"affected","version":"python 3.5.6"},{"status":"affected","version":"python 3.7.0"}]}],"modified":"2026-10-08T21:03:15.208Z","provider":"cve","references":["https://www.debian.org/security/2018/dsa-4306","https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html","https://bugs.python.org/issue32981","https://usn.ubuntu.com/3817-2/","https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-release-candidate-1","https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-6-release-candidate-1","https://access.redhat.com/errata/RHSA-2018:3505","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1060","https://access.redhat.com/errata/RHSA-2018:3041","https://www.debian.org/security/2018/dsa-4307","https://usn.ubuntu.com/3817-1/","https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2019:1260","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03951en_us","https://access.redhat.com/errata/RHSA-2019:3725","https://www.oracle.com/security-alerts/cpujan2020.html"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.debian.org/security/2018/dsa-4306","name":"DSA-4306","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://www.securitytracker.com/id/1042001","name":"1042001","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html","name":"[debian-lts-announce] 20180926 [SECURITY] [DLA 1520-1] python3.4 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://bugs.python.org/issue32981","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://usn.ubuntu.com/3817-2/","name":"USN-3817-2","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-release-candidate-1","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-6-release-candidate-1","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3505","name":"RHSA-2018:3505","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1060","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3041","name":"RHSA-2018:3041","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://www.debian.org/security/2018/dsa-4307","name":"DSA-4307","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://usn.ubuntu.com/3817-1/","name":"USN-3817-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html","name":"[debian-lts-announce] 20180925 [SECURITY] [DLA 1519-1] python2.7 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/","name":"FEDORA-2019-6e1938a3c5","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/","name":"FEDORA-2019-cf725dd20b","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/","name":"FEDORA-2019-51f1e08207","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://access.redhat.com/errata/RHBA-2019:0327","name":"RHBA-2019:0327","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1260","name":"RHSA-2019:1260","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03951en_us","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3725","name":"RHSA-2019:3725","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","name":"openSUSE-SU-2020:0086","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-05T03:44:12.002Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2018-1060","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-08T20:55:43.581364Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T21:03:15.208Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2020-01-21T21:06:22.000Z"}}},"related_cves":[{"value":"CVE-2018-1060","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:cf60a0f9-893e-41a9-af41-e25f3c48cb7e","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2018-1060","advisory_id":"cf60a0f9-893e-41a9-af41-e25f3c48cb7e","event_types":["advisory"],"published_at":"2026-10-25T01:05:03.298941+00:00","technologies":["core-cve","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2018-06-18T14:00:00+00:00","detail_url":"/advisories/advisory%3Acf60a0f9-893e-41a9-af41-e25f3c48cb7e","group":{"id":"advisory:cf60a0f9-893e-41a9-af41-e25f3c48cb7e","revision":1,"primary_event_id":15749,"change":"published","superseded_by":[],"changed":{"id":15749,"cve_ids":["CVE-2018-1060"],"payload":{"kind":"advisory","title":"CVE-2018-1060","summary":"python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.","evidence":"cve:CVE-2018-1060","products":[{"name":{"value":"python","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2018-1060","aliases":["CVE-2018-1060"],"metrics":[{"cvssV3_0":{"scope":"UNCHANGED","version":"3.0","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"[UNKNOWN]","product":"python","versions":[{"status":"affected","version":"python 2.7.15"},{"status":"affected","version":"python 3.4.9"},{"status":"affected","version":"python 3.5.6"},{"status":"affected","version":"python 3.7.0"}]}],"modified":"2026-10-08T21:03:15.208Z","provider":"cve","references":["https://www.debian.org/security/2018/dsa-4306","https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html","https://bugs.python.org/issue32981","https://usn.ubuntu.com/3817-2/","https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-release-candidate-1","https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-6-release-candidate-1","https://access.redhat.com/errata/RHSA-2018:3505","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1060","https://access.redhat.com/errata/RHSA-2018:3041","https://www.debian.org/security/2018/dsa-4307","https://usn.ubuntu.com/3817-1/","https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2019:1260","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03951en_us","https://access.redhat.com/errata/RHSA-2019:3725","https://www.oracle.com/security-alerts/cpujan2020.html"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.debian.org/security/2018/dsa-4306","name":"DSA-4306","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://www.securitytracker.com/id/1042001","name":"1042001","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html","name":"[debian-lts-announce] 20180926 [SECURITY] [DLA 1520-1] python3.4 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://bugs.python.org/issue32981","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://usn.ubuntu.com/3817-2/","name":"USN-3817-2","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-release-candidate-1","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-6-release-candidate-1","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3505","name":"RHSA-2018:3505","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1060","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3041","name":"RHSA-2018:3041","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://www.debian.org/security/2018/dsa-4307","name":"DSA-4307","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://usn.ubuntu.com/3817-1/","name":"USN-3817-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html","name":"[debian-lts-announce] 20180925 [SECURITY] [DLA 1519-1] python2.7 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/","name":"FEDORA-2019-6e1938a3c5","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/","name":"FEDORA-2019-cf725dd20b","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/","name":"FEDORA-2019-51f1e08207","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://access.redhat.com/errata/RHBA-2019:0327","name":"RHBA-2019:0327","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1260","name":"RHSA-2019:1260","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03951en_us","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3725","name":"RHSA-2019:3725","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","name":"openSUSE-SU-2020:0086","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-05T03:44:12.002Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2018-1060","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-08T20:55:43.581364Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T21:03:15.208Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2020-01-21T21:06:22.000Z"}}},"related_cves":[{"value":"CVE-2018-1060","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:cf60a0f9-893e-41a9-af41-e25f3c48cb7e","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2018-1060","advisory_id":"cf60a0f9-893e-41a9-af41-e25f3c48cb7e","event_types":["advisory"],"published_at":"2026-10-25T01:05:03.298941+00:00","technologies":["core-cve","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2018-06-18T14:00:00+00:00","detail_url":"/events/15749"},"members":[{"id":15749,"cve_ids":["CVE-2018-1060"],"payload":{"kind":"advisory","title":"CVE-2018-1060","summary":"python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.","evidence":"cve:CVE-2018-1060","products":[{"name":{"value":"python","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2018-1060","aliases":["CVE-2018-1060"],"metrics":[{"cvssV3_0":{"scope":"UNCHANGED","version":"3.0","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"[UNKNOWN]","product":"python","versions":[{"status":"affected","version":"python 2.7.15"},{"status":"affected","version":"python 3.4.9"},{"status":"affected","version":"python 3.5.6"},{"status":"affected","version":"python 3.7.0"}]}],"modified":"2026-10-08T21:03:15.208Z","provider":"cve","references":["https://www.debian.org/security/2018/dsa-4306","https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html","https://bugs.python.org/issue32981","https://usn.ubuntu.com/3817-2/","https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-release-candidate-1","https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-6-release-candidate-1","https://access.redhat.com/errata/RHSA-2018:3505","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1060","https://access.redhat.com/errata/RHSA-2018:3041","https://www.debian.org/security/2018/dsa-4307","https://usn.ubuntu.com/3817-1/","https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2019:1260","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03951en_us","https://access.redhat.com/errata/RHSA-2019:3725","https://www.oracle.com/security-alerts/cpujan2020.html"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.debian.org/security/2018/dsa-4306","name":"DSA-4306","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://www.securitytracker.com/id/1042001","name":"1042001","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html","name":"[debian-lts-announce] 20180926 [SECURITY] [DLA 1520-1] python3.4 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://bugs.python.org/issue32981","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://usn.ubuntu.com/3817-2/","name":"USN-3817-2","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-release-candidate-1","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-6-release-candidate-1","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3505","name":"RHSA-2018:3505","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1060","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3041","name":"RHSA-2018:3041","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://www.debian.org/security/2018/dsa-4307","name":"DSA-4307","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://usn.ubuntu.com/3817-1/","name":"USN-3817-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html","name":"[debian-lts-announce] 20180925 [SECURITY] [DLA 1519-1] python2.7 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/","name":"FEDORA-2019-6e1938a3c5","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/","name":"FEDORA-2019-cf725dd20b","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/","name":"FEDORA-2019-51f1e08207","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://access.redhat.com/errata/RHBA-2019:0327","name":"RHBA-2019:0327","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1260","name":"RHSA-2019:1260","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03951en_us","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3725","name":"RHSA-2019:3725","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","name":"openSUSE-SU-2020:0086","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-05T03:44:12.002Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2018-1060","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-08T20:55:43.581364Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T21:03:15.208Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2020-01-21T21:06:22.000Z"}}},"related_cves":[{"value":"CVE-2018-1060","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:cf60a0f9-893e-41a9-af41-e25f3c48cb7e","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2018-1060","advisory_id":"cf60a0f9-893e-41a9-af41-e25f3c48cb7e","event_types":["advisory"],"published_at":"2026-10-25T01:05:03.298941+00:00","technologies":["core-cve","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2018-06-18T14:00:00+00:00","detail_url":"/events/15749"}]}},{"id":12218,"cve_ids":["CVE-2019-5010"],"payload":{"kind":"advisory","title":"CVE-2019-5010","summary":"An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability.","evidence":"cve:CVE-2019-5010","products":[{"name":{"value":"Python","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2019-5010","aliases":["CVE-2019-5010"],"metrics":[{"cvssV3_0":{"scope":"UNCHANGED","version":"3.0","baseScore":5.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"n/a","product":"Python","versions":[{"status":"affected","version":"Python.org CPython 2.7.11 Python.org CPython 3.6.6 Python.org CPython 3.5.2 Python.org CPython 3 master at 480833808e918a1dcebbbcfd07d5a8de3c5c2a66"}]}],"modified":"2026-10-07T18:55:25.413Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2019:3520","https://access.redhat.com/errata/RHSA-2019:3725","https://security.gentoo.org/glsa/202003-26","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://talosintelligence.com/vulnerability_reports/TALOS-2019-0758"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://access.redhat.com/errata/RHSA-2019:3520","name":"RHSA-2019:3520","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3725","name":"RHSA-2019:3725","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","name":"openSUSE-SU-2020:0086","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://security.gentoo.org/glsa/202003-26","name":"GLSA-202003-26","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","name":"[debian-lts-announce] 20200715 [SECURITY] [DLA 2280-1] python3.5 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","name":"[bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","name":"[debian-lts-announce] 20200822 [SECURITY] [DLA 2337-1] python2.7 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2019-0758","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-04T19:40:49.196Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2019-5010","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-07T18:55:12.122902Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-07T18:55:25.413Z"}}],"cna":{"orgId":"b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b","shortName":"talos","dateUpdated":"2022-04-19T17:32:41.000Z"}}},"related_cves":[{"value":"CVE-2019-5010","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:bf008c32-9983-43e9-ba57-2e27263669e8","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2019-5010","advisory_id":"bf008c32-9983-43e9-ba57-2e27263669e8","event_types":["advisory"],"published_at":"2026-10-25T00:02:51.86277+00:00","technologies":["core-cve","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2019-10-31T20:05:57+00:00","detail_url":"/advisories/advisory%3Abf008c32-9983-43e9-ba57-2e27263669e8","group":{"id":"advisory:bf008c32-9983-43e9-ba57-2e27263669e8","revision":1,"primary_event_id":12161,"change":"published","superseded_by":[],"changed":{"id":12161,"cve_ids":["CVE-2019-5010"],"payload":{"kind":"advisory","title":"CVE-2019-5010","summary":"An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability.","evidence":"cve:CVE-2019-5010","products":[{"name":{"value":"Python","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2019-5010","aliases":["CVE-2019-5010"],"metrics":[{"cvssV3_0":{"scope":"UNCHANGED","version":"3.0","baseScore":5.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"n/a","product":"Python","versions":[{"status":"affected","version":"Python.org CPython 2.7.11 Python.org CPython 3.6.6 Python.org CPython 3.5.2 Python.org CPython 3 master at 480833808e918a1dcebbbcfd07d5a8de3c5c2a66"}]}],"modified":"2026-10-07T18:55:25.413Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2019:3520","https://access.redhat.com/errata/RHSA-2019:3725","https://security.gentoo.org/glsa/202003-26","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://talosintelligence.com/vulnerability_reports/TALOS-2019-0758"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://access.redhat.com/errata/RHSA-2019:3520","name":"RHSA-2019:3520","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3725","name":"RHSA-2019:3725","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","name":"openSUSE-SU-2020:0086","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://security.gentoo.org/glsa/202003-26","name":"GLSA-202003-26","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","name":"[debian-lts-announce] 20200715 [SECURITY] [DLA 2280-1] python3.5 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","name":"[bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","name":"[debian-lts-announce] 20200822 [SECURITY] [DLA 2337-1] python2.7 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2019-0758","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-04T19:40:49.196Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2019-5010","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-07T18:55:12.122902Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-07T18:55:25.413Z"}}],"cna":{"orgId":"b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b","shortName":"talos","dateUpdated":"2022-04-19T17:32:41.000Z"}}},"related_cves":[{"value":"CVE-2019-5010","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:bf008c32-9983-43e9-ba57-2e27263669e8","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2019-5010","advisory_id":"bf008c32-9983-43e9-ba57-2e27263669e8","event_types":["advisory"],"published_at":"2026-10-25T00:02:51.86277+00:00","technologies":["core-cve","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2019-10-31T20:05:57+00:00","detail_url":"/events/12161"},"members":[{"id":12161,"cve_ids":["CVE-2019-5010"],"payload":{"kind":"advisory","title":"CVE-2019-5010","summary":"An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability.","evidence":"cve:CVE-2019-5010","products":[{"name":{"value":"Python","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2019-5010","aliases":["CVE-2019-5010"],"metrics":[{"cvssV3_0":{"scope":"UNCHANGED","version":"3.0","baseScore":5.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"n/a","product":"Python","versions":[{"status":"affected","version":"Python.org CPython 2.7.11 Python.org CPython 3.6.6 Python.org CPython 3.5.2 Python.org CPython 3 master at 480833808e918a1dcebbbcfd07d5a8de3c5c2a66"}]}],"modified":"2026-10-07T18:55:25.413Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2019:3520","https://access.redhat.com/errata/RHSA-2019:3725","https://security.gentoo.org/glsa/202003-26","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://talosintelligence.com/vulnerability_reports/TALOS-2019-0758"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://access.redhat.com/errata/RHSA-2019:3520","name":"RHSA-2019:3520","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3725","name":"RHSA-2019:3725","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","name":"openSUSE-SU-2020:0086","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://security.gentoo.org/glsa/202003-26","name":"GLSA-202003-26","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","name":"[debian-lts-announce] 20200715 [SECURITY] [DLA 2280-1] python3.5 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","name":"[bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","name":"[debian-lts-announce] 20200822 [SECURITY] [DLA 2337-1] python2.7 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2019-0758","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-04T19:40:49.196Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2019-5010","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-07T18:55:12.122902Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-07T18:55:25.413Z"}}],"cna":{"orgId":"b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b","shortName":"talos","dateUpdated":"2022-04-19T17:32:41.000Z"}}},"related_cves":[{"value":"CVE-2019-5010","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:bf008c32-9983-43e9-ba57-2e27263669e8","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2019-5010","advisory_id":"bf008c32-9983-43e9-ba57-2e27263669e8","event_types":["advisory"],"published_at":"2026-10-25T00:02:51.86277+00:00","technologies":["core-cve","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2019-10-31T20:05:57+00:00","detail_url":"/events/12161"}]}},{"id":12199,"cve_ids":["CVE-2018-14647"],"payload":{"kind":"advisory","title":"CVE-2018-14647","summary":"Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15.","evidence":"cve:CVE-2018-14647","products":[{"name":{"value":"Python","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2018-14647","aliases":["CVE-2018-14647"],"metrics":[{"cvssV3_0":{"scope":"UNCHANGED","version":"3.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"The Python Project","product":"Python","versions":[{"status":"affected","version":"3.8, 3.7, 3.6, 3.5, 3.4, 2.7"}]}],"modified":"2026-10-07T18:29:03.175Z","provider":"cve","references":["https://www.debian.org/security/2018/dsa-4306","https://usn.ubuntu.com/3817-2/","https://www.debian.org/security/2018/dsa-4307","https://bugs.python.org/issue34623","https://usn.ubuntu.com/3817-1/","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14647","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBJCB2HWOJLP3L7CUQHJHNBHLSVOXJE5/","https://access.redhat.com/errata/RHSA-2019:1260","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3725","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.debian.org/security/2018/dsa-4306","name":"DSA-4306","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://usn.ubuntu.com/3817-2/","name":"USN-3817-2","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"http://www.securitytracker.com/id/1041740","name":"1041740","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://www.securityfocus.com/bid/105396","name":"105396","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://www.debian.org/security/2018/dsa-4307","name":"DSA-4307","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://bugs.python.org/issue34623","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://usn.ubuntu.com/3817-1/","name":"USN-3817-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14647","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBJCB2HWOJLP3L7CUQHJHNBHLSVOXJE5/","name":"FEDORA-2019-0c91ce7b3c","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1260","name":"RHSA-2019:1260","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","name":"[debian-lts-announce] 20190625 [SECURITY] [DLA 1834-1] python2.7 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","name":"[debian-lts-announce] 20190625 [SECURITY] [DLA 1835-1] python3.4 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2030","name":"RHSA-2019:2030","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3725","name":"RHSA-2019:3725","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","name":"openSUSE-SU-2020:0086","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","name":"[bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image","tags":["mailing-list","x_refsource_MLIST","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-05T09:38:13.104Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2018-14647","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-07T18:28:53.788379Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-07T18:29:03.175Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2020-07-29T11:06:41.000Z"}}},"related_cves":[{"value":"CVE-2018-14647","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:98aa69c8-0934-4148-839c-3f7580b60832","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2018-14647","advisory_id":"98aa69c8-0934-4148-839c-3f7580b60832","event_types":["advisory"],"published_at":"2026-10-25T00:02:39.84208+00:00","technologies":["core-cve","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2018-09-25T00:00:00+00:00","detail_url":"/advisories/advisory%3A98aa69c8-0934-4148-839c-3f7580b60832","group":{"id":"advisory:98aa69c8-0934-4148-839c-3f7580b60832","revision":1,"primary_event_id":12142,"change":"published","superseded_by":[],"changed":{"id":12142,"cve_ids":["CVE-2018-14647"],"payload":{"kind":"advisory","title":"CVE-2018-14647","summary":"Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15.","evidence":"cve:CVE-2018-14647","products":[{"name":{"value":"Python","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2018-14647","aliases":["CVE-2018-14647"],"metrics":[{"cvssV3_0":{"scope":"UNCHANGED","version":"3.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"The Python Project","product":"Python","versions":[{"status":"affected","version":"3.8, 3.7, 3.6, 3.5, 3.4, 2.7"}]}],"modified":"2026-10-07T18:29:03.175Z","provider":"cve","references":["https://www.debian.org/security/2018/dsa-4306","https://usn.ubuntu.com/3817-2/","https://www.debian.org/security/2018/dsa-4307","https://bugs.python.org/issue34623","https://usn.ubuntu.com/3817-1/","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14647","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBJCB2HWOJLP3L7CUQHJHNBHLSVOXJE5/","https://access.redhat.com/errata/RHSA-2019:1260","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3725","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.debian.org/security/2018/dsa-4306","name":"DSA-4306","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://usn.ubuntu.com/3817-2/","name":"USN-3817-2","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"http://www.securitytracker.com/id/1041740","name":"1041740","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://www.securityfocus.com/bid/105396","name":"105396","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://www.debian.org/security/2018/dsa-4307","name":"DSA-4307","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://bugs.python.org/issue34623","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://usn.ubuntu.com/3817-1/","name":"USN-3817-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14647","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBJCB2HWOJLP3L7CUQHJHNBHLSVOXJE5/","name":"FEDORA-2019-0c91ce7b3c","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1260","name":"RHSA-2019:1260","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","name":"[debian-lts-announce] 20190625 [SECURITY] [DLA 1834-1] python2.7 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","name":"[debian-lts-announce] 20190625 [SECURITY] [DLA 1835-1] python3.4 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2030","name":"RHSA-2019:2030","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3725","name":"RHSA-2019:3725","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","name":"openSUSE-SU-2020:0086","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","name":"[bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image","tags":["mailing-list","x_refsource_MLIST","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-05T09:38:13.104Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2018-14647","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-07T18:28:53.788379Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-07T18:29:03.175Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2020-07-29T11:06:41.000Z"}}},"related_cves":[{"value":"CVE-2018-14647","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:98aa69c8-0934-4148-839c-3f7580b60832","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2018-14647","advisory_id":"98aa69c8-0934-4148-839c-3f7580b60832","event_types":["advisory"],"published_at":"2026-10-25T00:02:39.84208+00:00","technologies":["core-cve","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2018-09-25T00:00:00+00:00","detail_url":"/events/12142"},"members":[{"id":12142,"cve_ids":["CVE-2018-14647"],"payload":{"kind":"advisory","title":"CVE-2018-14647","summary":"Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15.","evidence":"cve:CVE-2018-14647","products":[{"name":{"value":"Python","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2018-14647","aliases":["CVE-2018-14647"],"metrics":[{"cvssV3_0":{"scope":"UNCHANGED","version":"3.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"The Python Project","product":"Python","versions":[{"status":"affected","version":"3.8, 3.7, 3.6, 3.5, 3.4, 2.7"}]}],"modified":"2026-10-07T18:29:03.175Z","provider":"cve","references":["https://www.debian.org/security/2018/dsa-4306","https://usn.ubuntu.com/3817-2/","https://www.debian.org/security/2018/dsa-4307","https://bugs.python.org/issue34623","https://usn.ubuntu.com/3817-1/","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14647","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBJCB2HWOJLP3L7CUQHJHNBHLSVOXJE5/","https://access.redhat.com/errata/RHSA-2019:1260","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3725","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.debian.org/security/2018/dsa-4306","name":"DSA-4306","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://usn.ubuntu.com/3817-2/","name":"USN-3817-2","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"http://www.securitytracker.com/id/1041740","name":"1041740","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://www.securityfocus.com/bid/105396","name":"105396","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://www.debian.org/security/2018/dsa-4307","name":"DSA-4307","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://bugs.python.org/issue34623","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://usn.ubuntu.com/3817-1/","name":"USN-3817-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14647","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBJCB2HWOJLP3L7CUQHJHNBHLSVOXJE5/","name":"FEDORA-2019-0c91ce7b3c","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1260","name":"RHSA-2019:1260","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","name":"[debian-lts-announce] 20190625 [SECURITY] [DLA 1834-1] python2.7 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","name":"[debian-lts-announce] 20190625 [SECURITY] [DLA 1835-1] python3.4 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2030","name":"RHSA-2019:2030","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3725","name":"RHSA-2019:3725","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","name":"openSUSE-SU-2020:0086","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","name":"[bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image","tags":["mailing-list","x_refsource_MLIST","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-05T09:38:13.104Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2018-14647","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-07T18:28:53.788379Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-07T18:29:03.175Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2020-07-29T11:06:41.000Z"}}},"related_cves":[{"value":"CVE-2018-14647","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:98aa69c8-0934-4148-839c-3f7580b60832","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2018-14647","advisory_id":"98aa69c8-0934-4148-839c-3f7580b60832","event_types":["advisory"],"published_at":"2026-10-25T00:02:39.84208+00:00","technologies":["core-cve","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2018-09-25T00:00:00+00:00","detail_url":"/events/12142"}]}},{"id":8209,"cve_ids":["CVE-2026-19445"],"payload":{"kind":"advisory","title":"Use-after-free of a server-side SSLContext when sni_callback switches contexts","summary":"A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the original ssl.SSLContext alive. Typical cases are servers that create an SSLContext per connection or replace it while connections are open; servers that wrap their listening socket with it are not affected. Mitigation: keep a reference to every SSLContext that sets sni_callback for the lifetime of the server. TLS clients are not affected.","evidence":"cve:CVE-2026-19445","products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-19445","aliases":["CVE-2026-19445"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":9.2,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"CRITICAL","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/python/cpython","vendor":"Python Software Foundation","modules":["ssl"],"product":"CPython","versions":[{"status":"affected","version":"0","lessThan":"3.10.22","versionType":"python"},{"status":"affected","version":"3.11.0","lessThan":"3.11.17","versionType":"python"},{"status":"affected","version":"3.12.0","lessThan":"3.12.15","versionType":"python"},{"status":"affected","version":"3.13.0","lessThan":"3.13.16","versionType":"python"},{"status":"affected","version":"3.14.0","lessThan":"3.14.8","versionType":"python"},{"status":"affected","version":"3.15.0a1","lessThan":"3.15.0rc3","versionType":"python"}],"defaultStatus":"unaffected"}],"modified":"2026-10-03T00:36:46.398Z","provider":"cve","references":["https://github.com/python/cpython/pull/158504","https://mail.python.org/archives/list/security-announce@python.org/thread/QMQIUQB6WGGC3MI7I3WKQXOYOBDSPPS3/","https://github.com/python/cpython/issues/156293","https://github.com/python/cpython/commit/34a53dce8174da2fceb12fe084a4def02a10053d","https://github.com/python/cpython/commit/46133cd57d309652139ada74014aca7665ac552b","https://github.com/python/cpython/commit/63fab143d94cafae71850831acfb52041ba44af7","https://github.com/python/cpython/commit/cd7e51e7d4563866fbaa1e2521ae69b45daf3698","https://github.com/python/cpython/commit/d8717ed01717a9641686e6e6f83f0ab8af235e2c","https://github.com/python/cpython/commit/b12968cefe69ca1dcb8606c832ff73ee7dbf4ba8","https://github.com/python/cpython/commit/ec44b5a3258cbda947d5e07242ee562ed05ef24b"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/09/30/17"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-09-30T18:09:39.735Z"}}],"cna":{"orgId":"28c92f92-d60d-412d-b760-e73465c3df22","shortName":"PSF","dateUpdated":"2026-10-03T00:36:46.398Z"}}},"related_cves":[{"value":"CVE-2026-19445","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:6188b3ad-8a0b-4bcc-91c2-b954e004fabf","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-19445","advisory_id":"6188b3ad-8a0b-4bcc-91c2-b954e004fabf","event_types":["advisory"],"published_at":"2026-10-24T22:57:03.535168+00:00","technologies":["core-cve","cpython"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T16:16:04.923+00:00","detail_url":"/advisories/advisory%3A6188b3ad-8a0b-4bcc-91c2-b954e004fabf","group":{"id":"advisory:6188b3ad-8a0b-4bcc-91c2-b954e004fabf","revision":1,"primary_event_id":8203,"change":"published","superseded_by":[],"changed":{"id":8203,"cve_ids":["CVE-2026-19445"],"payload":{"kind":"advisory","title":"Use-after-free of a server-side SSLContext when sni_callback switches contexts","summary":"A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the original ssl.SSLContext alive. Typical cases are servers that create an SSLContext per connection or replace it while connections are open; servers that wrap their listening socket with it are not affected. Mitigation: keep a reference to every SSLContext that sets sni_callback for the lifetime of the server. TLS clients are not affected.","evidence":"cve:CVE-2026-19445","products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-19445","aliases":["CVE-2026-19445"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":9.2,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"CRITICAL","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/python/cpython","vendor":"Python Software Foundation","modules":["ssl"],"product":"CPython","versions":[{"status":"affected","version":"0","lessThan":"3.10.22","versionType":"python"},{"status":"affected","version":"3.11.0","lessThan":"3.11.17","versionType":"python"},{"status":"affected","version":"3.12.0","lessThan":"3.12.15","versionType":"python"},{"status":"affected","version":"3.13.0","lessThan":"3.13.16","versionType":"python"},{"status":"affected","version":"3.14.0","lessThan":"3.14.8","versionType":"python"},{"status":"affected","version":"3.15.0a1","lessThan":"3.15.0rc3","versionType":"python"}],"defaultStatus":"unaffected"}],"modified":"2026-10-03T00:36:46.398Z","provider":"cve","references":["https://github.com/python/cpython/pull/158504","https://mail.python.org/archives/list/security-announce@python.org/thread/QMQIUQB6WGGC3MI7I3WKQXOYOBDSPPS3/","https://github.com/python/cpython/issues/156293","https://github.com/python/cpython/commit/34a53dce8174da2fceb12fe084a4def02a10053d","https://github.com/python/cpython/commit/46133cd57d309652139ada74014aca7665ac552b","https://github.com/python/cpython/commit/63fab143d94cafae71850831acfb52041ba44af7","https://github.com/python/cpython/commit/cd7e51e7d4563866fbaa1e2521ae69b45daf3698","https://github.com/python/cpython/commit/d8717ed01717a9641686e6e6f83f0ab8af235e2c","https://github.com/python/cpython/commit/b12968cefe69ca1dcb8606c832ff73ee7dbf4ba8","https://github.com/python/cpython/commit/ec44b5a3258cbda947d5e07242ee562ed05ef24b"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/09/30/17"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-09-30T18:09:39.735Z"}}],"cna":{"orgId":"28c92f92-d60d-412d-b760-e73465c3df22","shortName":"PSF","dateUpdated":"2026-10-03T00:36:46.398Z"}}},"related_cves":[{"value":"CVE-2026-19445","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:6188b3ad-8a0b-4bcc-91c2-b954e004fabf","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-19445","advisory_id":"6188b3ad-8a0b-4bcc-91c2-b954e004fabf","event_types":["advisory"],"published_at":"2026-10-24T22:57:03.535168+00:00","technologies":["core-cve","cpython"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T16:16:04.923+00:00","detail_url":"/events/8203"},"members":[{"id":8203,"cve_ids":["CVE-2026-19445"],"payload":{"kind":"advisory","title":"Use-after-free of a server-side SSLContext when sni_callback switches contexts","summary":"A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the original ssl.SSLContext alive. Typical cases are servers that create an SSLContext per connection or replace it while connections are open; servers that wrap their listening socket with it are not affected. Mitigation: keep a reference to every SSLContext that sets sni_callback for the lifetime of the server. TLS clients are not affected.","evidence":"cve:CVE-2026-19445","products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-19445","aliases":["CVE-2026-19445"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":9.2,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"CRITICAL","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/python/cpython","vendor":"Python Software Foundation","modules":["ssl"],"product":"CPython","versions":[{"status":"affected","version":"0","lessThan":"3.10.22","versionType":"python"},{"status":"affected","version":"3.11.0","lessThan":"3.11.17","versionType":"python"},{"status":"affected","version":"3.12.0","lessThan":"3.12.15","versionType":"python"},{"status":"affected","version":"3.13.0","lessThan":"3.13.16","versionType":"python"},{"status":"affected","version":"3.14.0","lessThan":"3.14.8","versionType":"python"},{"status":"affected","version":"3.15.0a1","lessThan":"3.15.0rc3","versionType":"python"}],"defaultStatus":"unaffected"}],"modified":"2026-10-03T00:36:46.398Z","provider":"cve","references":["https://github.com/python/cpython/pull/158504","https://mail.python.org/archives/list/security-announce@python.org/thread/QMQIUQB6WGGC3MI7I3WKQXOYOBDSPPS3/","https://github.com/python/cpython/issues/156293","https://github.com/python/cpython/commit/34a53dce8174da2fceb12fe084a4def02a10053d","https://github.com/python/cpython/commit/46133cd57d309652139ada74014aca7665ac552b","https://github.com/python/cpython/commit/63fab143d94cafae71850831acfb52041ba44af7","https://github.com/python/cpython/commit/cd7e51e7d4563866fbaa1e2521ae69b45daf3698","https://github.com/python/cpython/commit/d8717ed01717a9641686e6e6f83f0ab8af235e2c","https://github.com/python/cpython/commit/b12968cefe69ca1dcb8606c832ff73ee7dbf4ba8","https://github.com/python/cpython/commit/ec44b5a3258cbda947d5e07242ee562ed05ef24b"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/09/30/17"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-09-30T18:09:39.735Z"}}],"cna":{"orgId":"28c92f92-d60d-412d-b760-e73465c3df22","shortName":"PSF","dateUpdated":"2026-10-03T00:36:46.398Z"}}},"related_cves":[{"value":"CVE-2026-19445","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:6188b3ad-8a0b-4bcc-91c2-b954e004fabf","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-19445","advisory_id":"6188b3ad-8a0b-4bcc-91c2-b954e004fabf","event_types":["advisory"],"published_at":"2026-10-24T22:57:03.535168+00:00","technologies":["core-cve","cpython"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T16:16:04.923+00:00","detail_url":"/events/8203"}]}},{"id":7819,"cve_ids":["CVE-2026-7210"],"payload":{"kind":"advisory","title":"The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection","summary":"`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.","evidence":"cve:CVE-2026-7210","products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-7210","aliases":["CVE-2026-7210"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6.3,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/python/cpython","vendor":"Python Software Foundation","modules":["xml","expat"],"product":"CPython","versions":[{"status":"affected","version":"0","lessThan":"3.10.22","versionType":"python"},{"status":"affected","version":"3.11.0","lessThan":"3.11.16","versionType":"python"},{"status":"affected","version":"3.12.0","lessThan":"3.12.14","versionType":"python"},{"status":"affected","version":"3.13.0","lessThan":"3.13.14","versionType":"python"},{"status":"affected","version":"3.14.0","lessThan":"3.14.6","versionType":"python"},{"status":"affected","version":"3.15.0a1","lessThan":"3.15.0b2","versionType":"python"}],"defaultStatus":"unaffected"}],"modified":"2026-10-02T00:35:51.824Z","provider":"cve","references":["https://mail.python.org/archives/list/security-announce@python.org/thread/PNY5OMBDPM2FRUZTWFFPJ6LISWKV627K/","https://github.com/python/cpython/pull/149023","https://github.com/python/cpython/issues/149018","https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4","https://github.com/python/cpython/commit/3573b3b1ecbd99030a0b18658e1bfece771b2566","https://github.com/python/cpython/commit/eeea765cb9d8f1fc3d8918b272ac3c477983f27a","https://github.com/python/cpython/commit/fc9b11ff49cbc82e6f917d07a61517a2b5f3145f","https://github.com/python/cpython/commit/e37df2a6a71d6538698e2d3188a7c345b827640b","https://github.com/python/cpython/commit/cbaecf9f16da611a646d507c1cbca265c588fc56","https://github.com/python/cpython/commit/ea70712d1a8508e14e9677d44f838dab04dc0286"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-7210","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-05-11T18:53:57.884366Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-05-11T18:54:12.868Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/05/11/8"},{"url":"http://www.openwall.com/lists/oss-security/2026/05/11/13"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-05-11T20:34:17.811Z"}}],"cna":{"orgId":"28c92f92-d60d-412d-b760-e73465c3df22","shortName":"PSF","dateUpdated":"2026-10-02T00:35:51.824Z"}}},"related_cves":[{"value":"CVE-2026-7210","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:5e65f41d-2165-401e-9eec-d784ee275d8f","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-7210","advisory_id":"5e65f41d-2165-401e-9eec-d784ee275d8f","event_types":["advisory"],"published_at":"2026-10-24T22:50:26.863976+00:00","technologies":["core-cve","cpython"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-05-11T17:19:09.784+00:00","detail_url":"/advisories/advisory%3A5e65f41d-2165-401e-9eec-d784ee275d8f","group":{"id":"advisory:5e65f41d-2165-401e-9eec-d784ee275d8f","revision":1,"primary_event_id":7816,"change":"published","superseded_by":[],"changed":{"id":7816,"cve_ids":["CVE-2026-7210"],"payload":{"kind":"advisory","title":"The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection","summary":"`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.","evidence":"cve:CVE-2026-7210","products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-7210","aliases":["CVE-2026-7210"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6.3,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/python/cpython","vendor":"Python Software Foundation","modules":["xml","expat"],"product":"CPython","versions":[{"status":"affected","version":"0","lessThan":"3.10.22","versionType":"python"},{"status":"affected","version":"3.11.0","lessThan":"3.11.16","versionType":"python"},{"status":"affected","version":"3.12.0","lessThan":"3.12.14","versionType":"python"},{"status":"affected","version":"3.13.0","lessThan":"3.13.14","versionType":"python"},{"status":"affected","version":"3.14.0","lessThan":"3.14.6","versionType":"python"},{"status":"affected","version":"3.15.0a1","lessThan":"3.15.0b2","versionType":"python"}],"defaultStatus":"unaffected"}],"modified":"2026-10-02T00:35:51.824Z","provider":"cve","references":["https://mail.python.org/archives/list/security-announce@python.org/thread/PNY5OMBDPM2FRUZTWFFPJ6LISWKV627K/","https://github.com/python/cpython/pull/149023","https://github.com/python/cpython/issues/149018","https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4","https://github.com/python/cpython/commit/3573b3b1ecbd99030a0b18658e1bfece771b2566","https://github.com/python/cpython/commit/eeea765cb9d8f1fc3d8918b272ac3c477983f27a","https://github.com/python/cpython/commit/fc9b11ff49cbc82e6f917d07a61517a2b5f3145f","https://github.com/python/cpython/commit/e37df2a6a71d6538698e2d3188a7c345b827640b","https://github.com/python/cpython/commit/cbaecf9f16da611a646d507c1cbca265c588fc56","https://github.com/python/cpython/commit/ea70712d1a8508e14e9677d44f838dab04dc0286"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-7210","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-05-11T18:53:57.884366Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-05-11T18:54:12.868Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/05/11/8"},{"url":"http://www.openwall.com/lists/oss-security/2026/05/11/13"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-05-11T20:34:17.811Z"}}],"cna":{"orgId":"28c92f92-d60d-412d-b760-e73465c3df22","shortName":"PSF","dateUpdated":"2026-10-02T00:35:51.824Z"}}},"related_cves":[{"value":"CVE-2026-7210","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:5e65f41d-2165-401e-9eec-d784ee275d8f","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-7210","advisory_id":"5e65f41d-2165-401e-9eec-d784ee275d8f","event_types":["advisory"],"published_at":"2026-10-24T22:50:26.863976+00:00","technologies":["core-cve","cpython"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-05-11T17:19:09.784+00:00","detail_url":"/events/7816"},"members":[{"id":7816,"cve_ids":["CVE-2026-7210"],"payload":{"kind":"advisory","title":"The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection","summary":"`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.","evidence":"cve:CVE-2026-7210","products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-7210","aliases":["CVE-2026-7210"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6.3,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/python/cpython","vendor":"Python Software Foundation","modules":["xml","expat"],"product":"CPython","versions":[{"status":"affected","version":"0","lessThan":"3.10.22","versionType":"python"},{"status":"affected","version":"3.11.0","lessThan":"3.11.16","versionType":"python"},{"status":"affected","version":"3.12.0","lessThan":"3.12.14","versionType":"python"},{"status":"affected","version":"3.13.0","lessThan":"3.13.14","versionType":"python"},{"status":"affected","version":"3.14.0","lessThan":"3.14.6","versionType":"python"},{"status":"affected","version":"3.15.0a1","lessThan":"3.15.0b2","versionType":"python"}],"defaultStatus":"unaffected"}],"modified":"2026-10-02T00:35:51.824Z","provider":"cve","references":["https://mail.python.org/archives/list/security-announce@python.org/thread/PNY5OMBDPM2FRUZTWFFPJ6LISWKV627K/","https://github.com/python/cpython/pull/149023","https://github.com/python/cpython/issues/149018","https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4","https://github.com/python/cpython/commit/3573b3b1ecbd99030a0b18658e1bfece771b2566","https://github.com/python/cpython/commit/eeea765cb9d8f1fc3d8918b272ac3c477983f27a","https://github.com/python/cpython/commit/fc9b11ff49cbc82e6f917d07a61517a2b5f3145f","https://github.com/python/cpython/commit/e37df2a6a71d6538698e2d3188a7c345b827640b","https://github.com/python/cpython/commit/cbaecf9f16da611a646d507c1cbca265c588fc56","https://github.com/python/cpython/commit/ea70712d1a8508e14e9677d44f838dab04dc0286"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-7210","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-05-11T18:53:57.884366Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-05-11T18:54:12.868Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/05/11/8"},{"url":"http://www.openwall.com/lists/oss-security/2026/05/11/13"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-05-11T20:34:17.811Z"}}],"cna":{"orgId":"28c92f92-d60d-412d-b760-e73465c3df22","shortName":"PSF","dateUpdated":"2026-10-02T00:35:51.824Z"}}},"related_cves":[{"value":"CVE-2026-7210","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:5e65f41d-2165-401e-9eec-d784ee275d8f","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-7210","advisory_id":"5e65f41d-2165-401e-9eec-d784ee275d8f","event_types":["advisory"],"published_at":"2026-10-24T22:50:26.863976+00:00","technologies":["core-cve","cpython"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-05-11T17:19:09.784+00:00","detail_url":"/events/7816"}]}},{"id":7818,"cve_ids":["CVE-2026-17084"],"payload":{"kind":"advisory","title":"stringprep.map_table_b2() deviates from RFC 3454 Table B.2","summary":"The \"stringprep\" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA 2003 (the \"idna\" codec) and the in_table_b2() function of the \"stringprep\" module. This only affects domain names containing characters that were not previously registered or had their Unicode attributes such as case-folding behavior updated since Unicode 3.2.0.","evidence":"cve:CVE-2026-17084","products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-17084","aliases":["CVE-2026-17084"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/python/cpython","vendor":"Python Software Foundation","modules":["stringprep","idna"],"product":"CPython","versions":[{"status":"affected","version":"0","lessThan":"3.10.22","versionType":"python"},{"status":"affected","version":"3.11.0","lessThan":"3.11.17","versionType":"python"},{"status":"affected","version":"3.12.0","lessThan":"3.12.15","versionType":"python"},{"status":"affected","version":"3.13.0","lessThan":"3.13.16","versionType":"python"},{"status":"affected","version":"3.14.0","lessThan":"3.14.8","versionType":"python"},{"status":"affected","version":"3.15.0a1","lessThan":"3.15.0rc2","versionType":"python"}],"defaultStatus":"unaffected"}],"modified":"2026-10-02T00:39:09.384Z","provider":"cve","references":["https://github.com/python/cpython/pull/155293","https://github.com/python/cpython/issues/155292","https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/","https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bc","https://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7","https://github.com/python/cpython/commit/1e54caa096678a38afcabecabb1ff72400dd6bae","https://github.com/python/cpython/commit/c016c2535b74227fddf2cf7334dbfead6c930214","https://github.com/python/cpython/commit/c28b121a4f0b975937c8b5a1b4934bb361d84296","https://github.com/python/cpython/commit/c42790b34f634051750e5da340d17c7da19e4784","https://github.com/python/cpython/commit/69f92ebaec681e9149dfd70fd02d4ed52d2a6296","https://github.com/python/cpython/commit/d397a4979cfc80a8cd6c73838aa10e9c8cf5ef72"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-17084","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-08-18T16:03:21.438212Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-436","description":"CWE-436 Interpretation Conflict"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-18T16:03:44.732Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/08/18/2"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-08-18T17:08:22.725Z"}}],"cna":{"orgId":"28c92f92-d60d-412d-b760-e73465c3df22","shortName":"PSF","dateUpdated":"2026-10-02T00:39:09.384Z"}}},"related_cves":[{"value":"CVE-2026-17084","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:83d1f732-05fd-477f-9b82-b193f7053bb8","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-17084","advisory_id":"83d1f732-05fd-477f-9b82-b193f7053bb8","event_types":["advisory"],"published_at":"2026-10-24T22:50:26.095024+00:00","technologies":["core-cve","cpython"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-18T13:57:31.876+00:00","detail_url":"/advisories/advisory%3A83d1f732-05fd-477f-9b82-b193f7053bb8","group":{"id":"advisory:83d1f732-05fd-477f-9b82-b193f7053bb8","revision":1,"primary_event_id":7815,"change":"published","superseded_by":[],"changed":{"id":7815,"cve_ids":["CVE-2026-17084"],"payload":{"kind":"advisory","title":"stringprep.map_table_b2() deviates from RFC 3454 Table B.2","summary":"The \"stringprep\" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA 2003 (the \"idna\" codec) and the in_table_b2() function of the \"stringprep\" module. This only affects domain names containing characters that were not previously registered or had their Unicode attributes such as case-folding behavior updated since Unicode 3.2.0.","evidence":"cve:CVE-2026-17084","products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-17084","aliases":["CVE-2026-17084"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/python/cpython","vendor":"Python Software Foundation","modules":["stringprep","idna"],"product":"CPython","versions":[{"status":"affected","version":"0","lessThan":"3.10.22","versionType":"python"},{"status":"affected","version":"3.11.0","lessThan":"3.11.17","versionType":"python"},{"status":"affected","version":"3.12.0","lessThan":"3.12.15","versionType":"python"},{"status":"affected","version":"3.13.0","lessThan":"3.13.16","versionType":"python"},{"status":"affected","version":"3.14.0","lessThan":"3.14.8","versionType":"python"},{"status":"affected","version":"3.15.0a1","lessThan":"3.15.0rc2","versionType":"python"}],"defaultStatus":"unaffected"}],"modified":"2026-10-02T00:39:09.384Z","provider":"cve","references":["https://github.com/python/cpython/pull/155293","https://github.com/python/cpython/issues/155292","https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/","https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bc","https://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7","https://github.com/python/cpython/commit/1e54caa096678a38afcabecabb1ff72400dd6bae","https://github.com/python/cpython/commit/c016c2535b74227fddf2cf7334dbfead6c930214","https://github.com/python/cpython/commit/c28b121a4f0b975937c8b5a1b4934bb361d84296","https://github.com/python/cpython/commit/c42790b34f634051750e5da340d17c7da19e4784","https://github.com/python/cpython/commit/69f92ebaec681e9149dfd70fd02d4ed52d2a6296","https://github.com/python/cpython/commit/d397a4979cfc80a8cd6c73838aa10e9c8cf5ef72"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-17084","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-08-18T16:03:21.438212Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-436","description":"CWE-436 Interpretation Conflict"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-18T16:03:44.732Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/08/18/2"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-08-18T17:08:22.725Z"}}],"cna":{"orgId":"28c92f92-d60d-412d-b760-e73465c3df22","shortName":"PSF","dateUpdated":"2026-10-02T00:39:09.384Z"}}},"related_cves":[{"value":"CVE-2026-17084","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:83d1f732-05fd-477f-9b82-b193f7053bb8","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-17084","advisory_id":"83d1f732-05fd-477f-9b82-b193f7053bb8","event_types":["advisory"],"published_at":"2026-10-24T22:50:26.095024+00:00","technologies":["core-cve","cpython"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-18T13:57:31.876+00:00","detail_url":"/events/7815"},"members":[{"id":7815,"cve_ids":["CVE-2026-17084"],"payload":{"kind":"advisory","title":"stringprep.map_table_b2() deviates from RFC 3454 Table B.2","summary":"The \"stringprep\" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA 2003 (the \"idna\" codec) and the in_table_b2() function of the \"stringprep\" module. This only affects domain names containing characters that were not previously registered or had their Unicode attributes such as case-folding behavior updated since Unicode 3.2.0.","evidence":"cve:CVE-2026-17084","products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-17084","aliases":["CVE-2026-17084"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/python/cpython","vendor":"Python Software Foundation","modules":["stringprep","idna"],"product":"CPython","versions":[{"status":"affected","version":"0","lessThan":"3.10.22","versionType":"python"},{"status":"affected","version":"3.11.0","lessThan":"3.11.17","versionType":"python"},{"status":"affected","version":"3.12.0","lessThan":"3.12.15","versionType":"python"},{"status":"affected","version":"3.13.0","lessThan":"3.13.16","versionType":"python"},{"status":"affected","version":"3.14.0","lessThan":"3.14.8","versionType":"python"},{"status":"affected","version":"3.15.0a1","lessThan":"3.15.0rc2","versionType":"python"}],"defaultStatus":"unaffected"}],"modified":"2026-10-02T00:39:09.384Z","provider":"cve","references":["https://github.com/python/cpython/pull/155293","https://github.com/python/cpython/issues/155292","https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/","https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bc","https://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7","https://github.com/python/cpython/commit/1e54caa096678a38afcabecabb1ff72400dd6bae","https://github.com/python/cpython/commit/c016c2535b74227fddf2cf7334dbfead6c930214","https://github.com/python/cpython/commit/c28b121a4f0b975937c8b5a1b4934bb361d84296","https://github.com/python/cpython/commit/c42790b34f634051750e5da340d17c7da19e4784","https://github.com/python/cpython/commit/69f92ebaec681e9149dfd70fd02d4ed52d2a6296","https://github.com/python/cpython/commit/d397a4979cfc80a8cd6c73838aa10e9c8cf5ef72"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-17084","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-08-18T16:03:21.438212Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-436","description":"CWE-436 Interpretation Conflict"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-18T16:03:44.732Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/08/18/2"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-08-18T17:08:22.725Z"}}],"cna":{"orgId":"28c92f92-d60d-412d-b760-e73465c3df22","shortName":"PSF","dateUpdated":"2026-10-02T00:39:09.384Z"}}},"related_cves":[{"value":"CVE-2026-17084","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:83d1f732-05fd-477f-9b82-b193f7053bb8","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-17084","advisory_id":"83d1f732-05fd-477f-9b82-b193f7053bb8","event_types":["advisory"],"published_at":"2026-10-24T22:50:26.095024+00:00","technologies":["core-cve","cpython"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-18T13:57:31.876+00:00","detail_url":"/events/7815"}]}},{"id":7817,"cve_ids":["CVE-2026-15806"],"payload":{"kind":"advisory","title":"`HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching","summary":"The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication. Users who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs.","evidence":"cve:CVE-2026-15806","products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-15806","aliases":["CVE-2026-15806"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/python/cpython","vendor":"Python Software Foundation","product":"CPython","versions":[{"status":"affected","version":"0","lessThan":"3.10.22","versionType":"python"},{"status":"affected","version":"3.11.0","lessThan":"3.11.17","versionType":"python"},{"status":"affected","version":"3.12.0","lessThan":"3.12.15","versionType":"python"},{"status":"affected","version":"3.13.0","lessThan":"3.13.16","versionType":"python"},{"status":"affected","version":"3.14.0","lessThan":"3.14.8","versionType":"python"},{"status":"affected","version":"3.15.0a1","lessThan":"3.15.0rc2","versionType":"python"}],"defaultStatus":"unaffected"}],"modified":"2026-10-02T00:39:20.429Z","provider":"cve","references":["https://github.com/python/cpython/issues/155694","https://github.com/python/cpython/pull/155696","https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/","https://github.com/python/cpython/commit/a0d023fbd23773e24b35d8368789470e22cda5d8","https://github.com/python/cpython/commit/a2773a34183b7d94a243bb98fd658926cc5348ce","https://github.com/python/cpython/commit/a7bb524fef61f77ede01f660ffbd591e1d5837ce","https://github.com/python/cpython/commit/641be42bb07921ba0f8bffe228b1dc706b092ef6","https://github.com/python/cpython/commit/851cf9a7142ecbdd39f831055533f58284ad2bcc","https://github.com/python/cpython/commit/95355ee3a8e1d3c3d4858d1973aa42a9b91a2801","https://github.com/python/cpython/commit/dac88d8615078c55f1304ea4c7a2d822700d4e5a"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/08/18/3"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-08-18T18:07:31.778Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-15806","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-08-18T18:56:36.349726Z"}}}],"references":[{"url":"https://github.com/python/cpython/issues/155694","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-18T18:56:57.585Z"}}],"cna":{"orgId":"28c92f92-d60d-412d-b760-e73465c3df22","shortName":"PSF","dateUpdated":"2026-10-02T00:39:20.429Z"}}},"related_cves":[{"value":"CVE-2026-15806","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:70269379-75a8-45db-84e7-9225260aac23","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-15806","advisory_id":"70269379-75a8-45db-84e7-9225260aac23","event_types":["advisory"],"published_at":"2026-10-24T22:50:25.514442+00:00","technologies":["core-cve","cpython"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-18T15:50:57.983+00:00","detail_url":"/advisories/advisory%3A70269379-75a8-45db-84e7-9225260aac23","group":{"id":"advisory:70269379-75a8-45db-84e7-9225260aac23","revision":1,"primary_event_id":7814,"change":"published","superseded_by":[],"changed":{"id":7814,"cve_ids":["CVE-2026-15806"],"payload":{"kind":"advisory","title":"`HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching","summary":"The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication. Users who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs.","evidence":"cve:CVE-2026-15806","products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-15806","aliases":["CVE-2026-15806"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/python/cpython","vendor":"Python Software Foundation","product":"CPython","versions":[{"status":"affected","version":"0","lessThan":"3.10.22","versionType":"python"},{"status":"affected","version":"3.11.0","lessThan":"3.11.17","versionType":"python"},{"status":"affected","version":"3.12.0","lessThan":"3.12.15","versionType":"python"},{"status":"affected","version":"3.13.0","lessThan":"3.13.16","versionType":"python"},{"status":"affected","version":"3.14.0","lessThan":"3.14.8","versionType":"python"},{"status":"affected","version":"3.15.0a1","lessThan":"3.15.0rc2","versionType":"python"}],"defaultStatus":"unaffected"}],"modified":"2026-10-02T00:39:20.429Z","provider":"cve","references":["https://github.com/python/cpython/issues/155694","https://github.com/python/cpython/pull/155696","https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/","https://github.com/python/cpython/commit/a0d023fbd23773e24b35d8368789470e22cda5d8","https://github.com/python/cpython/commit/a2773a34183b7d94a243bb98fd658926cc5348ce","https://github.com/python/cpython/commit/a7bb524fef61f77ede01f660ffbd591e1d5837ce","https://github.com/python/cpython/commit/641be42bb07921ba0f8bffe228b1dc706b092ef6","https://github.com/python/cpython/commit/851cf9a7142ecbdd39f831055533f58284ad2bcc","https://github.com/python/cpython/commit/95355ee3a8e1d3c3d4858d1973aa42a9b91a2801","https://github.com/python/cpython/commit/dac88d8615078c55f1304ea4c7a2d822700d4e5a"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/08/18/3"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-08-18T18:07:31.778Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-15806","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-08-18T18:56:36.349726Z"}}}],"references":[{"url":"https://github.com/python/cpython/issues/155694","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-18T18:56:57.585Z"}}],"cna":{"orgId":"28c92f92-d60d-412d-b760-e73465c3df22","shortName":"PSF","dateUpdated":"2026-10-02T00:39:20.429Z"}}},"related_cves":[{"value":"CVE-2026-15806","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:70269379-75a8-45db-84e7-9225260aac23","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-15806","advisory_id":"70269379-75a8-45db-84e7-9225260aac23","event_types":["advisory"],"published_at":"2026-10-24T22:50:25.514442+00:00","technologies":["core-cve","cpython"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-18T15:50:57.983+00:00","detail_url":"/events/7814"},"members":[{"id":7814,"cve_ids":["CVE-2026-15806"],"payload":{"kind":"advisory","title":"`HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching","summary":"The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication. Users who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs.","evidence":"cve:CVE-2026-15806","products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-15806","aliases":["CVE-2026-15806"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/python/cpython","vendor":"Python Software Foundation","product":"CPython","versions":[{"status":"affected","version":"0","lessThan":"3.10.22","versionType":"python"},{"status":"affected","version":"3.11.0","lessThan":"3.11.17","versionType":"python"},{"status":"affected","version":"3.12.0","lessThan":"3.12.15","versionType":"python"},{"status":"affected","version":"3.13.0","lessThan":"3.13.16","versionType":"python"},{"status":"affected","version":"3.14.0","lessThan":"3.14.8","versionType":"python"},{"status":"affected","version":"3.15.0a1","lessThan":"3.15.0rc2","versionType":"python"}],"defaultStatus":"unaffected"}],"modified":"2026-10-02T00:39:20.429Z","provider":"cve","references":["https://github.com/python/cpython/issues/155694","https://github.com/python/cpython/pull/155696","https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/","https://github.com/python/cpython/commit/a0d023fbd23773e24b35d8368789470e22cda5d8","https://github.com/python/cpython/commit/a2773a34183b7d94a243bb98fd658926cc5348ce","https://github.com/python/cpython/commit/a7bb524fef61f77ede01f660ffbd591e1d5837ce","https://github.com/python/cpython/commit/641be42bb07921ba0f8bffe228b1dc706b092ef6","https://github.com/python/cpython/commit/851cf9a7142ecbdd39f831055533f58284ad2bcc","https://github.com/python/cpython/commit/95355ee3a8e1d3c3d4858d1973aa42a9b91a2801","https://github.com/python/cpython/commit/dac88d8615078c55f1304ea4c7a2d822700d4e5a"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/08/18/3"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-08-18T18:07:31.778Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-15806","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-08-18T18:56:36.349726Z"}}}],"references":[{"url":"https://github.com/python/cpython/issues/155694","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-18T18:56:57.585Z"}}],"cna":{"orgId":"28c92f92-d60d-412d-b760-e73465c3df22","shortName":"PSF","dateUpdated":"2026-10-02T00:39:20.429Z"}}},"related_cves":[{"value":"CVE-2026-15806","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:70269379-75a8-45db-84e7-9225260aac23","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-15806","advisory_id":"70269379-75a8-45db-84e7-9225260aac23","event_types":["advisory"],"published_at":"2026-10-24T22:50:25.514442+00:00","technologies":["core-cve","cpython"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-18T15:50:57.983+00:00","detail_url":"/events/7814"}]}},{"id":7816,"cve_ids":["CVE-2026-15310"],"payload":{"kind":"advisory","title":"zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits","summary":"When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion.","evidence":"cve:CVE-2026-15310","products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-15310","aliases":["CVE-2026-15310"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":2.1,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"LOW","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"ACTIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/python/cpython","vendor":"Python Software Foundation","product":"CPython","versions":[{"status":"affected","version":"0","lessThan":"3.10.22","versionType":"python"},{"status":"affected","version":"3.11.0","lessThan":"3.11.17","versionType":"python"},{"status":"affected","version":"3.12.0","lessThan":"3.12.15","versionType":"python"},{"status":"affected","version":"3.13.0","lessThan":"3.13.16","versionType":"python"},{"status":"affected","version":"3.14.0","lessThan":"3.14.8","versionType":"python"},{"status":"affected","version":"3.15.0a1","lessThan":"3.15.0rc2","versionType":"python"}],"defaultStatus":"unaffected"}],"modified":"2026-10-02T00:39:36.038Z","provider":"cve","references":["https://github.com/python/cpython/pull/156003","https://github.com/python/cpython/issues/156002","https://mail.python.org/archives/list/security-announce@python.org/thread/YUHXURX2WZGKGNA4ANYBQS2VZRYQ5JNK/","https://github.com/python/cpython/commit/f897dbf2f36a5935700b7c2d94d4681d2136b7d4","https://github.com/python/cpython/commit/1b424c0178a01e155fd0267dc28a8fc1159b33a8","https://github.com/python/cpython/commit/31980e84b9a708424a0a1dfecde3fc991e313f89","https://github.com/python/cpython/commit/e2311cfb3dd518f008f312fe0631f4f7490d237a","https://github.com/python/cpython/commit/f507e6946a3194e83e1d7b8ee6e14567175e46de","https://github.com/python/cpython/commit/9d167992b59cf5e23c66b9ed742b13f5925f7d70","https://github.com/python/cpython/commit/dcdd406ddbfc4cb29b24c3df17cbabe21d316ce1","https://github.com/python/cpython/commit/09a2e7e6678b4f65449e7ad8f112c48f944591e2","https://github.com/python/cpython/commit/6257029de42ef89b67f3d20137de87d43e197530","https://github.com/python/cpython/commit/c2bfbcdd1a11690507a10bc0998f95b8dc6b6fac"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-15310","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-08-25T15:34:06.442859Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-25T17:43:24.947Z"}}],"cna":{"orgId":"28c92f92-d60d-412d-b760-e73465c3df22","shortName":"PSF","dateUpdated":"2026-10-02T00:39:36.038Z"}}},"related_cves":[{"value":"CVE-2026-15310","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ebf06e68-5a21-42ca-aecf-443df5b19df7","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-15310","advisory_id":"ebf06e68-5a21-42ca-aecf-443df5b19df7","event_types":["advisory"],"published_at":"2026-10-24T22:50:24.945743+00:00","technologies":["core-cve","cpython"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-25T15:07:58.054+00:00","detail_url":"/advisories/advisory%3Aebf06e68-5a21-42ca-aecf-443df5b19df7","group":{"id":"advisory:ebf06e68-5a21-42ca-aecf-443df5b19df7","revision":1,"primary_event_id":7813,"change":"published","superseded_by":[],"changed":{"id":7813,"cve_ids":["CVE-2026-15310"],"payload":{"kind":"advisory","title":"zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits","summary":"When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion.","evidence":"cve:CVE-2026-15310","products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-15310","aliases":["CVE-2026-15310"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":2.1,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"LOW","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"ACTIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/python/cpython","vendor":"Python Software Foundation","product":"CPython","versions":[{"status":"affected","version":"0","lessThan":"3.10.22","versionType":"python"},{"status":"affected","version":"3.11.0","lessThan":"3.11.17","versionType":"python"},{"status":"affected","version":"3.12.0","lessThan":"3.12.15","versionType":"python"},{"status":"affected","version":"3.13.0","lessThan":"3.13.16","versionType":"python"},{"status":"affected","version":"3.14.0","lessThan":"3.14.8","versionType":"python"},{"status":"affected","version":"3.15.0a1","lessThan":"3.15.0rc2","versionType":"python"}],"defaultStatus":"unaffected"}],"modified":"2026-10-02T00:39:36.038Z","provider":"cve","references":["https://github.com/python/cpython/pull/156003","https://github.com/python/cpython/issues/156002","https://mail.python.org/archives/list/security-announce@python.org/thread/YUHXURX2WZGKGNA4ANYBQS2VZRYQ5JNK/","https://github.com/python/cpython/commit/f897dbf2f36a5935700b7c2d94d4681d2136b7d4","https://github.com/python/cpython/commit/1b424c0178a01e155fd0267dc28a8fc1159b33a8","https://github.com/python/cpython/commit/31980e84b9a708424a0a1dfecde3fc991e313f89","https://github.com/python/cpython/commit/e2311cfb3dd518f008f312fe0631f4f7490d237a","https://github.com/python/cpython/commit/f507e6946a3194e83e1d7b8ee6e14567175e46de","https://github.com/python/cpython/commit/9d167992b59cf5e23c66b9ed742b13f5925f7d70","https://github.com/python/cpython/commit/dcdd406ddbfc4cb29b24c3df17cbabe21d316ce1","https://github.com/python/cpython/commit/09a2e7e6678b4f65449e7ad8f112c48f944591e2","https://github.com/python/cpython/commit/6257029de42ef89b67f3d20137de87d43e197530","https://github.com/python/cpython/commit/c2bfbcdd1a11690507a10bc0998f95b8dc6b6fac"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-15310","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-08-25T15:34:06.442859Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-25T17:43:24.947Z"}}],"cna":{"orgId":"28c92f92-d60d-412d-b760-e73465c3df22","shortName":"PSF","dateUpdated":"2026-10-02T00:39:36.038Z"}}},"related_cves":[{"value":"CVE-2026-15310","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ebf06e68-5a21-42ca-aecf-443df5b19df7","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-15310","advisory_id":"ebf06e68-5a21-42ca-aecf-443df5b19df7","event_types":["advisory"],"published_at":"2026-10-24T22:50:24.945743+00:00","technologies":["core-cve","cpython"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-25T15:07:58.054+00:00","detail_url":"/events/7813"},"members":[{"id":7813,"cve_ids":["CVE-2026-15310"],"payload":{"kind":"advisory","title":"zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits","summary":"When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion.","evidence":"cve:CVE-2026-15310","products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-15310","aliases":["CVE-2026-15310"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":2.1,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"LOW","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"ACTIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/python/cpython","vendor":"Python Software Foundation","product":"CPython","versions":[{"status":"affected","version":"0","lessThan":"3.10.22","versionType":"python"},{"status":"affected","version":"3.11.0","lessThan":"3.11.17","versionType":"python"},{"status":"affected","version":"3.12.0","lessThan":"3.12.15","versionType":"python"},{"status":"affected","version":"3.13.0","lessThan":"3.13.16","versionType":"python"},{"status":"affected","version":"3.14.0","lessThan":"3.14.8","versionType":"python"},{"status":"affected","version":"3.15.0a1","lessThan":"3.15.0rc2","versionType":"python"}],"defaultStatus":"unaffected"}],"modified":"2026-10-02T00:39:36.038Z","provider":"cve","references":["https://github.com/python/cpython/pull/156003","https://github.com/python/cpython/issues/156002","https://mail.python.org/archives/list/security-announce@python.org/thread/YUHXURX2WZGKGNA4ANYBQS2VZRYQ5JNK/","https://github.com/python/cpython/commit/f897dbf2f36a5935700b7c2d94d4681d2136b7d4","https://github.com/python/cpython/commit/1b424c0178a01e155fd0267dc28a8fc1159b33a8","https://github.com/python/cpython/commit/31980e84b9a708424a0a1dfecde3fc991e313f89","https://github.com/python/cpython/commit/e2311cfb3dd518f008f312fe0631f4f7490d237a","https://github.com/python/cpython/commit/f507e6946a3194e83e1d7b8ee6e14567175e46de","https://github.com/python/cpython/commit/9d167992b59cf5e23c66b9ed742b13f5925f7d70","https://github.com/python/cpython/commit/dcdd406ddbfc4cb29b24c3df17cbabe21d316ce1","https://github.com/python/cpython/commit/09a2e7e6678b4f65449e7ad8f112c48f944591e2","https://github.com/python/cpython/commit/6257029de42ef89b67f3d20137de87d43e197530","https://github.com/python/cpython/commit/c2bfbcdd1a11690507a10bc0998f95b8dc6b6fac"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-15310","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-08-25T15:34:06.442859Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-25T17:43:24.947Z"}}],"cna":{"orgId":"28c92f92-d60d-412d-b760-e73465c3df22","shortName":"PSF","dateUpdated":"2026-10-02T00:39:36.038Z"}}},"related_cves":[{"value":"CVE-2026-15310","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ebf06e68-5a21-42ca-aecf-443df5b19df7","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-15310","advisory_id":"ebf06e68-5a21-42ca-aecf-443df5b19df7","event_types":["advisory"],"published_at":"2026-10-24T22:50:24.945743+00:00","technologies":["core-cve","cpython"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-25T15:07:58.054+00:00","detail_url":"/events/7813"}]}}],"next_after":57175,"next_before":7816}