Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,793

Export CSV
CVE-2018-12023

jackson-databind: improper polymorphic deserialization of types from Oracle JDBC driver

An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Oracle JDBC jar in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.

CVSS 3.0 · 7.5 High EPSS 8.9% KEV · Not listed
Vendors
Debian Fasterxml Fedoraproject and 2 more
Products
Debian Linux Jackson-databind Fedora and 17 more
CVE-2017-12172

postgresql: Start scripts permit database administrator to modify root-owned files

PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20, and 9.2.x before 9.2.24 runs under a non-root operating system account, and database superusers have effective ability to run arbitrary code under that system account. PostgreSQL provides a script for starting the database server during system boot. Packages of PostgreSQL for many operating systems provide their own, packager-authored startup implementations. Several implementations use a log file name that the database superuser can replace with a symbolic link. As root, they open(), chmod() and/or chown() this log file name. This often suffices for the database superuser to escalate to root privileges when root starts the server.

CVSS 3.0 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Postgresql Redhat
Products
Postgresql Enterprise Linux Rhel Software Collections and 1 more
CVE-2022-45061

python: CPU denial of service via inefficient IDNA decoder

An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16.

CVSS 3.1 · 7.5 High EPSS 3.3% KEV · Not listed
Vendors
Fedoraproject Netapp Python and 1 more
Products
Fedora Active Iq Unified Manager Bootstrap Os and 10 more
CVE-2022-0391

python: urllib.parse does not sanitize URLs containing ASCII newline and tabs

A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14.

CVSS 3.1 · 7.5 High EPSS 8.5% KEV · Not listed
Vendors
Fedoraproject Netapp Oracle and 2 more
Products
Fedora Active Iq Unified Manager Hci and 9 more
CVE-2021-28861

python: open redirection vulnerability in lib/http/server.py may lead to information disclosure

Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states "Warning: http.server is not recommended for production. It only implements basic security checks."

CVSS 3.1 · 6.5 Medium EPSS 2.8% KEV · Not listed
Vendors
Fedoraproject Python Redhat
Products
Fedora Python Enterprise Linux and 1 more
CVE-2021-23336

Web Cache Poisoning

The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.

CVSS 3.1 · 5.9 Medium EPSS 41.1% KEV · Not listed
Vendors
Debian Djangoproject Fedoraproject and 4 more
Products
Debian Linux Django Fedora and 11 more
CVE-2021-3737

python: urllib: HTTP client possible infinite loop on a 100 Continue response

A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 7.5 High EPSS 13.2% KEV · Not listed
Vendors
Canonical Fedoraproject Netapp and 3 more
Products
Ubuntu Linux Fedora Hci and 15 more
CVE-2021-3733

python: urllib: Regular expression DoS in AbstractBasicAuthHandler

There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.

CVSS 3.1 · 6.5 Medium EPSS 4.8% KEV · Not listed
Vendors
Fedoraproject Netapp Python and 1 more
Products
Extra Packages For Enterprise Linux Fedora Hci Compute Node Firmware and 18 more
CVE-2021-3426

python: Information disclosure via pydoc

There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server could access the server and use it to disclose sensitive information belonging to the other user that they would not normally be able to access. The highest risk of this flaw is to data confidentiality. This flaw affects Python versions before 3.8.9, Python versions before 3.9.3 and Python versions before 3.10.0a7.

CVSS 3.1 · 5.7 Medium EPSS 1.9% KEV · Not listed
Vendors
Debian Fedoraproject Netapp and 3 more
Products
Debian Linux Fedora Cloud Backup and 8 more
CVE-2021-3177

python: Stack-based buffer overflow in PyCArg_repr in _ctypes/callproc.c

Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.

CVSS 3.1 · 9.8 Critical EPSS 24.0% KEV · Not listed
Vendors
Debian Fedoraproject Netapp and 3 more
Products
Debian Linux Fedora Active Iq Unified Manager and 9 more
CVE-2020-26116

python: CRLF injection via HTTP request method in httplib/http.client

http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request.

CVSS 3.1 · 7.2 High EPSS 6.4% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 5 more
Products
Ubuntu Linux Debian Linux Fedora and 9 more
CVE-2020-14422

python: DoS via inefficiency in IPv{4,6}Interface classes

Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this attacker can cause many dictionary entries to be created. This is fixed in: v3.5.10, v3.5.10rc1; v3.6.12; v3.7.9; v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1; v3.9.0, v3.9.0b4, v3.9.0b5, v3.9.0rc1, v3.9.0rc2.

CVSS 3.1 · 5.9 Medium EPSS 12.7% KEV · Not listed
Vendors
Fedoraproject Opensuse Oracle and 2 more
Products
Fedora Leap Enterprise Manager Ops Center and 3 more
CVE-2020-8492

python: wrong backtracking in urllib.request.AbstractBasicAuthHandler allows for a ReDoS

Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.

CVSS 3.1 · 6.5 Medium EPSS 6.6% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 4 more
CVE-2020-10735

python: int() type in PyLong_FromString() does not limit amount of digits converting text to int leading to DoS

A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 6.2 Medium EPSS 4.5% KEV · Not listed
Vendors
Fedoraproject Python Redhat
Products
Fedora Python Enterprise Linux and 4 more
CVE-2020-10531

ICU: Integer overflow in UnicodeString::doAppend()

An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp.

CVSS 3.1 · 8.8 High EPSS 2.7% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 6 more
Products
Ubuntu Linux Debian Linux Fedora and 12 more
CVE-2019-20907

python: infinite loop in the tarfile module via crafted TAR archive

In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.

CVSS 3.1 · 5.5 Medium EPSS 3.0% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 5 more
Products
Ubuntu Linux Debian Linux Fedora and 12 more
CVE-2019-9948

python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms

urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.

CVSS 3.1 · 9.1 Critical EPSS 11.8% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 15 more
CVE-2019-9947

python: CRLF injection via the path part of the url passed to urlopen()

An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

CVSS 3.1 · 5.4 Medium EPSS 5.3% KEV · Not listed
Vendors
Python Redhat
Products
Python Ansible Tower Enterprise Linux and 5 more
CVE-2019-9740

python: CRLF injection via the query part of the url passed to urlopen()

An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

CVSS 3.1 · 6.5 Medium EPSS 5.4% KEV · Not listed
Vendors
Python Redhat
Products
Python Ansible Tower Enterprise Linux and 5 more