VulnerableCode Package Details - pkg:ebuild/dev-lang/python@3.11.0

Search for packages

Vulnerability	Summary	Fixed by
This package is not known to be affected by vulnerabilities.

Vulnerability

Summary

Fixed by

This package is not known to be affected by vulnerabilities.

Vulnerability	Summary	Aliases
VCID-4gsg-5e6s-63g4	Multiple vulnerabilities have been found in Python and PyPy, the worst of which could result in arbitrary code execution.	CVE-2021-28861
VCID-a8mv-mr3q-vygz	Multiple vulnerabilities have been found in Python and PyPy, the worst of which could result in arbitrary code execution.	CVE-2022-42919
VCID-bqp2-x383-xqfh	Multiple vulnerabilities have been found in Python and PyPy, the worst of which could result in arbitrary code execution.	CVE-2015-20107
VCID-ewbq-2gm8-tyf5	Buffer overflow in sponge queue functions ### Impact The Keccak sponge function interface accepts partial inputs to be absorbed and partial outputs to be squeezed. A buffer can overflow when partial data with some specific sizes are queued, where at least one of them has a length of 2^32 - 200 bytes or more. ### Patches Yes, see commit [fdc6fef0](https://github.com/XKCP/XKCP/commit/fdc6fef075f4e81d6b1bc38364248975e08e340a). ### Workarounds The problem can be avoided by limiting the size of the partial input data (or partial output digest) below 2^32 - 200 bytes. Multiple calls to the queue system can be chained at a higher level to retain the original functionality. Alternatively, one can process the entire input (or produce the entire output) at once, avoiding the queuing functions altogether. ### References See [issue #105](https://github.com/XKCP/XKCP/issues/105) for more details.	CVE-2022-37454 GHSA-6w4m-2xhg-2658
VCID-pu6r-vafw-gfe4	The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted.	CVE-2021-28363 GHSA-5phf-pp7p-vc2r PYSEC-2021-59
VCID-qqh6-evfk-1fgy	Multiple vulnerabilities have been found in Python and PyPy, the worst of which could result in arbitrary code execution.	CVE-2022-45061
VCID-vpwj-d49q-1uh8	Multiple vulnerabilities have been found in Python and PyPy, the worst of which could result in arbitrary code execution.	CVE-2022-0391
VCID-z48d-eyxz-bycq	Multiple vulnerabilities have been found in Python and PyPy, the worst of which could result in arbitrary code execution.	CVE-2021-29921
VCID-zwuz-pgjz-rkb9	URL Redirection to Untrusted Site ('Open Redirect') A vulnerability was found in openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL.	CVE-2021-3654 GHSA-vqp6-j452-j6wp

Vulnerability

Summary

Aliases

VCID-4gsg-5e6s-63g4

Multiple vulnerabilities have been found in Python and PyPy, the worst of which could result in arbitrary code execution.

CVE-2021-28861

VCID-a8mv-mr3q-vygz

Multiple vulnerabilities have been found in Python and PyPy, the worst of which could result in arbitrary code execution.

CVE-2022-42919

VCID-bqp2-x383-xqfh

Multiple vulnerabilities have been found in Python and PyPy, the worst of which could result in arbitrary code execution.

CVE-2015-20107

VCID-ewbq-2gm8-tyf5

Buffer overflow in sponge queue functions ### Impact The Keccak sponge function interface accepts partial inputs to be absorbed and partial outputs to be squeezed. A buffer can overflow when partial data with some specific sizes are queued, where at least one of them has a length of 2^32 - 200 bytes or more. ### Patches Yes, see commit [fdc6fef0](https://github.com/XKCP/XKCP/commit/fdc6fef075f4e81d6b1bc38364248975e08e340a). ### Workarounds The problem can be avoided by limiting the size of the partial input data (or partial output digest) below 2^32 - 200 bytes. Multiple calls to the queue system can be chained at a higher level to retain the original functionality. Alternatively, one can process the entire input (or produce the entire output) at once, avoiding the queuing functions altogether. ### References See [issue #105](https://github.com/XKCP/XKCP/issues/105) for more details.

CVE-2022-37454
GHSA-6w4m-2xhg-2658

VCID-pu6r-vafw-gfe4

The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted.

CVE-2021-28363
GHSA-5phf-pp7p-vc2r
PYSEC-2021-59

VCID-qqh6-evfk-1fgy

Multiple vulnerabilities have been found in Python and PyPy, the worst of which could result in arbitrary code execution.

CVE-2022-45061

VCID-vpwj-d49q-1uh8

Multiple vulnerabilities have been found in Python and PyPy, the worst of which could result in arbitrary code execution.

CVE-2022-0391

VCID-z48d-eyxz-bycq

Multiple vulnerabilities have been found in Python and PyPy, the worst of which could result in arbitrary code execution.

CVE-2021-29921

VCID-zwuz-pgjz-rkb9

URL Redirection to Untrusted Site ('Open Redirect') A vulnerability was found in openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL.

CVE-2021-3654
GHSA-vqp6-j452-j6wp

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-01T13:01:25.050368+00:00	Gentoo Importer	Fixing	VCID-qqh6-evfk-1fgy	https://security.gentoo.org/glsa/202305-02	38.0.0
2026-04-01T13:01:24.996412+00:00	Gentoo Importer	Fixing	VCID-a8mv-mr3q-vygz	https://security.gentoo.org/glsa/202305-02	38.0.0
2026-04-01T13:01:24.943948+00:00	Gentoo Importer	Fixing	VCID-ewbq-2gm8-tyf5	https://security.gentoo.org/glsa/202305-02	38.0.0
2026-04-01T13:01:24.893621+00:00	Gentoo Importer	Fixing	VCID-vpwj-d49q-1uh8	https://security.gentoo.org/glsa/202305-02	38.0.0
2026-04-01T13:01:24.846310+00:00	Gentoo Importer	Fixing	VCID-z48d-eyxz-bycq	https://security.gentoo.org/glsa/202305-02	38.0.0
2026-04-01T13:01:24.795491+00:00	Gentoo Importer	Fixing	VCID-4gsg-5e6s-63g4	https://security.gentoo.org/glsa/202305-02	38.0.0
2026-04-01T13:01:24.745959+00:00	Gentoo Importer	Fixing	VCID-pu6r-vafw-gfe4	https://security.gentoo.org/glsa/202305-02	38.0.0
2026-04-01T13:01:24.695903+00:00	Gentoo Importer	Fixing	VCID-zwuz-pgjz-rkb9	https://security.gentoo.org/glsa/202305-02	38.0.0
2026-04-01T13:01:24.641133+00:00	Gentoo Importer	Fixing	VCID-bqp2-x383-xqfh	https://security.gentoo.org/glsa/202305-02	38.0.0