CGIHandler: sets environmental variable based on user supplied Proxy request header

The CGIHandler class in Python before 2.7.12 does not protect against the HTTP_PROXY variable name clash in a CGI script, which could allow a remote attacker to redirect HTTP requests.

python: CGIHTTPServer module does not properly handle URL-encoded path separators in URLs

The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f separator.

The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten.

python: XMLRPC library unrestricted decompression of HTTP responses using gzip enconding

The gzip_decode function in the xmlrpc client library in Python 3.4 and earlier allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP request.

Python keyring has insecure permissions on new databases allowing world-readable files to be created

Python keyring lib before 0.10 created keyring files with world-readable permissions.

PyXML: hash table collisions CPU usage DoS (oCERT-2011-003)

PyXML: Hash table collisions CPU usage Denial of Service