Search for packages
Package details: pkg:deb/debian/python3.9@3.9.2-1
purl pkg:deb/debian/python3.9@3.9.2-1
Next non-vulnerable version None.
Latest non-vulnerable version None.
Risk 4.4
Vulnerabilities affecting this package (26)
Vulnerability Summary Fixed by
VCID-1n4c-69xu-aaae
Aliases:
CVE-2021-3733
There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability. There are no reported fixed by versions.
VCID-1yvf-qg2w-aaan
Aliases:
CVE-2022-42919
Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non-default configuration. The Python multiprocessing library, when used with the forkserver start method on Linux, allows pickles to be deserialized from any user in the same machine local network namespace, which in many system configurations means any user on the same machine. Pickles can execute arbitrary code. Thus, this allows for local user privilege escalation to the user that any forkserver process is running as. Setting multiprocessing.util.abstract_sockets_supported to False is a workaround. The forkserver start method for multiprocessing is not the default start method. This issue is Linux specific because only Linux supports abstract namespace sockets. CPython before 3.9 does not make use of Linux abstract namespace sockets by default. Support for users manually specifying an abstract namespace socket was added as a bugfix in 3.7.8 and 3.8.3, but users would need to make specific uncommon API calls in order to do that in CPython before 3.9. There are no reported fixed by versions.
VCID-1zqs-cabz-23ep
Aliases:
CVE-2024-8088
There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class is unaffected. When iterating over names of entries in a zip archive (for example, methods of "zipfile.Path" like "namelist()", "iterdir()", etc) the process can be put into an infinite loop with a maliciously crafted zip archive. This defect applies when reading only metadata or extracting the contents of the zip archive. Programs that are not handling user-controlled zip archives are not affected. There are no reported fixed by versions.
VCID-469d-4hfp-fygd
Aliases:
CVE-2024-9287
A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren't activated before being used (ie "./venv/bin/python") are not affected. There are no reported fixed by versions.
VCID-69wz-uwzh-aaam
Aliases:
CVE-2021-28861
Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. There are no reported fixed by versions.
VCID-9sf2-nk96-z7g1
Aliases:
CVE-2024-11168
The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser. There are no reported fixed by versions.
VCID-adb7-t68d-aaah
Aliases:
CVE-2023-6597
An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference symlinks during cleanup of permissions-related errors. This means users which can run privileged programs are potentially able to modify permissions of files referenced by symlinks in some circumstances. There are no reported fixed by versions.
VCID-bdw7-d7up-aaaf
Aliases:
CVE-2021-4189
A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible. There are no reported fixed by versions.
VCID-cgzx-bygy-zyh7
Aliases:
CVE-2024-7592
There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used while parsing the value. There are no reported fixed by versions.
VCID-dg6w-9abx-aaap
Aliases:
CVE-2024-4032
The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the is_private and is_global properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network classes, where values wouldn’t be returned in accordance with the latest information from the IANA Special-Purpose Address Registries. CPython 3.12.4 and 3.13.0a6 contain updated information from these registries and thus have the intended behavior. There are no reported fixed by versions.
VCID-dymx-8r2e-aaad
Aliases:
CVE-2021-3426
There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server could access the server and use it to disclose sensitive information belonging to the other user that they would not normally be able to access. The highest risk of this flaw is to data confidentiality. This flaw affects Python versions before 3.8.9, Python versions before 3.9.3 and Python versions before 3.10.0a7. There are no reported fixed by versions.
VCID-fxcv-tgm2-aaac
Aliases:
CVE-2020-10735
CVE-2020-10735 python: int() type in PyLong_FromString() does not limit amount of digits converting text to int leading to DoS There are no reported fixed by versions.
VCID-gf6k-frsj-aaas
Aliases:
CVE-2023-40217
An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If a TLS server-side socket is created, receives data into the socket buffer, and then is closed quickly, there is a brief window where the SSLSocket instance will detect the socket as "not connected" and won't initiate a handshake, but buffered data will still be readable from the socket buffer. This data will not be authenticated if the server-side TLS peer is expecting client certificate authentication, and is indistinguishable from valid TLS stream data. Data is limited in size to the amount that will fit in the buffer. (The TLS connection cannot directly be used for data exfiltration because the vulnerable code path requires that the connection be closed on initialization of the SSLSocket.) There are no reported fixed by versions.
VCID-hq7h-468r-aaad
Aliases:
CVE-2021-3737
A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability. There are no reported fixed by versions.
VCID-ks3f-4xzz-aaae
Aliases:
CVE-2015-20107
In Python (aka CPython) through 3.10.4, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). There are no reported fixed by versions.
VCID-kxt9-wr47-aaaf
Aliases:
CVE-2024-0450
An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The zipfile module is vulnerable to “quoted-overlap” zip-bombs which exploit the zip format to create a zip-bomb with a high compression ratio. The fixed versions of CPython makes the zipfile module reject zip archives which overlap entries in the archive. There are no reported fixed by versions.
VCID-mjvp-khak-aaad
Aliases:
CVE-2024-6923
There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized. There are no reported fixed by versions.
VCID-mmtt-7cs6-5qae
Aliases:
CVE-2024-6232
There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives. There are no reported fixed by versions.
VCID-nuws-q4cw-aaae
Aliases:
CVE-2022-45061
An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16. There are no reported fixed by versions.
VCID-ttvn-gv7h-aaaq
Aliases:
CVE-2022-0391
A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14. There are no reported fixed by versions.
VCID-u5e1-ny7x-aaab
Aliases:
CVE-2024-0397
A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at the same time as certificates are loaded into the SSLContext, such as during the TLS handshake with a certificate directory configured. This issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5. There are no reported fixed by versions.
VCID-w2tb-3y5k-4kf7
Aliases:
CVE-2025-1795
python: Mishandling of comma during folding and unicode-encoding of email headers There are no reported fixed by versions.
VCID-w518-7svn-ybfu
Aliases:
CVE-2025-0938
python: cpython: URL parser allowed square brackets in domain names There are no reported fixed by versions.
VCID-y1sw-wnzq-aaae
Aliases:
CVE-2023-24329
An issue in the urllib.parse component of Python before v3.11 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters. There are no reported fixed by versions.
VCID-y2w8-eze9-aaar
Aliases:
CVE-2021-29921
In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses. There are no reported fixed by versions.
VCID-zx7c-pz97-aaar
Aliases:
CVE-2023-27043
The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python. There are no reported fixed by versions.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2025-06-22T07:03:12.133832+00:00 Debian Importer Affected by VCID-y2w8-eze9-aaar None 36.1.3
2025-06-21T21:59:38.535634+00:00 Debian Importer Affected by VCID-hq7h-468r-aaad None 36.1.3
2025-06-21T21:42:22.720217+00:00 Debian Importer Affected by VCID-1n4c-69xu-aaae None 36.1.3
2025-06-21T09:40:05.603053+00:00 Debian Importer Affected by VCID-dymx-8r2e-aaad None 36.1.3
2025-06-20T23:07:06.266444+00:00 Debian Importer Affected by VCID-bdw7-d7up-aaaf None 36.1.3
2025-04-13T03:09:07.711715+00:00 Debian Oval Importer Affected by VCID-ttvn-gv7h-aaaq https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.0.0
2025-04-13T03:06:12.484082+00:00 Debian Oval Importer Affected by VCID-w2tb-3y5k-4kf7 https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.0.0
2025-04-13T02:54:58.467854+00:00 Debian Oval Importer Affected by VCID-w518-7svn-ybfu https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.0.0
2025-04-13T02:27:41.758793+00:00 Debian Oval Importer Affected by VCID-nuws-q4cw-aaae https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.0.0
2025-04-13T02:27:37.399646+00:00 Debian Oval Importer Affected by VCID-y1sw-wnzq-aaae https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.0.0
2025-04-13T02:27:34.612975+00:00 Debian Oval Importer Affected by VCID-bdw7-d7up-aaaf https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.0.0
2025-04-13T02:27:33.216544+00:00 Debian Oval Importer Affected by VCID-zx7c-pz97-aaar https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.0.0
2025-04-13T02:27:22.918384+00:00 Debian Oval Importer Affected by VCID-mmtt-7cs6-5qae https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.0.0
2025-04-13T02:27:20.733146+00:00 Debian Oval Importer Affected by VCID-fxcv-tgm2-aaac https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.0.0
2025-04-13T02:27:20.070516+00:00 Debian Oval Importer Affected by VCID-dg6w-9abx-aaap https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.0.0
2025-04-13T02:27:16.604070+00:00 Debian Oval Importer Affected by VCID-469d-4hfp-fygd https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.0.0
2025-04-13T02:27:14.563580+00:00 Debian Oval Importer Affected by VCID-dymx-8r2e-aaad https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.0.0
2025-04-13T02:27:10.076280+00:00 Debian Oval Importer Affected by VCID-1yvf-qg2w-aaan https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.0.0
2025-04-13T02:27:05.746250+00:00 Debian Oval Importer Affected by VCID-u5e1-ny7x-aaab https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.0.0
2025-04-13T02:27:05.081374+00:00 Debian Oval Importer Affected by VCID-1n4c-69xu-aaae https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.0.0
2025-04-13T02:27:02.909921+00:00 Debian Oval Importer Affected by VCID-ks3f-4xzz-aaae https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.0.0
2025-04-13T02:27:02.239582+00:00 Debian Oval Importer Affected by VCID-adb7-t68d-aaah https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.0.0
2025-04-13T02:26:55.057684+00:00 Debian Oval Importer Affected by VCID-69wz-uwzh-aaam https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.0.0
2025-04-13T02:26:54.392733+00:00 Debian Oval Importer Affected by VCID-y2w8-eze9-aaar https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.0.0
2025-04-13T02:26:51.594817+00:00 Debian Oval Importer Affected by VCID-1zqs-cabz-23ep https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.0.0
2025-04-13T02:26:48.744107+00:00 Debian Oval Importer Affected by VCID-cgzx-bygy-zyh7 https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.0.0
2025-04-13T02:26:46.507761+00:00 Debian Oval Importer Affected by VCID-9sf2-nk96-z7g1 https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.0.0
2025-04-13T02:26:45.840707+00:00 Debian Oval Importer Affected by VCID-gf6k-frsj-aaas https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.0.0
2025-04-13T02:26:39.630690+00:00 Debian Oval Importer Affected by VCID-kxt9-wr47-aaaf https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.0.0
2025-04-13T02:26:37.480111+00:00 Debian Oval Importer Affected by VCID-hq7h-468r-aaad https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.0.0
2025-04-13T02:26:36.103761+00:00 Debian Oval Importer Affected by VCID-mjvp-khak-aaad https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.0.0
2025-04-07T00:08:48.123824+00:00 Debian Importer Affected by VCID-ttvn-gv7h-aaaq None 36.0.0
2025-04-06T00:42:30.822747+00:00 Debian Importer Affected by VCID-y2w8-eze9-aaar None 36.0.0
2025-04-05T18:00:27.756202+00:00 Debian Importer Affected by VCID-hq7h-468r-aaad None 36.0.0
2025-04-05T17:42:26.435341+00:00 Debian Importer Affected by VCID-1n4c-69xu-aaae None 36.0.0
2025-04-05T06:56:50.480684+00:00 Debian Importer Affected by VCID-dymx-8r2e-aaad None 36.0.0
2025-04-04T01:46:55.490825+00:00 Debian Importer Affected by VCID-bdw7-d7up-aaaf None 36.0.0
2025-02-20T11:26:34.445270+00:00 Debian Importer Affected by VCID-ttvn-gv7h-aaaq None 35.1.0
2025-02-20T06:48:07.542818+00:00 Debian Importer Affected by VCID-bdw7-d7up-aaaf None 35.1.0
2025-02-20T03:00:46.074027+00:00 Debian Importer Affected by VCID-hq7h-468r-aaad None 35.1.0
2025-02-20T02:53:26.560528+00:00 Debian Importer Affected by VCID-1n4c-69xu-aaae None 35.1.0
2025-02-20T01:57:59.874977+00:00 Debian Importer Affected by VCID-dymx-8r2e-aaad None 35.1.0
2025-02-19T21:57:34.169192+00:00 Debian Importer Affected by VCID-y2w8-eze9-aaar None 35.1.0
2024-11-23T04:40:35.960134+00:00 Debian Importer Affected by VCID-ttvn-gv7h-aaaq None 35.0.0
2024-11-23T00:39:16.381814+00:00 Debian Importer Affected by VCID-bdw7-d7up-aaaf None 35.0.0
2024-11-22T20:49:57.706181+00:00 Debian Importer Affected by VCID-hq7h-468r-aaad None 35.0.0
2024-11-22T20:49:40.210267+00:00 Debian Importer Affected by VCID-1n4c-69xu-aaae None 35.0.0
2024-11-22T19:58:08.665248+00:00 Debian Importer Affected by VCID-dymx-8r2e-aaad None 35.0.0
2024-10-10T02:55:36.003541+00:00 Debian Importer Affected by VCID-ttvn-gv7h-aaaq None 34.0.2
2024-10-09T23:06:26.901284+00:00 Debian Importer Affected by VCID-bdw7-d7up-aaaf None 34.0.2
2024-10-09T19:22:08.767560+00:00 Debian Importer Affected by VCID-hq7h-468r-aaad None 34.0.2
2024-10-09T19:21:56.540871+00:00 Debian Importer Affected by VCID-1n4c-69xu-aaae None 34.0.2
2024-10-09T18:40:52.735222+00:00 Debian Importer Affected by VCID-dymx-8r2e-aaad None 34.0.2
2024-09-19T09:53:38.116694+00:00 Debian Importer Affected by VCID-ttvn-gv7h-aaaq None 34.0.1
2024-09-19T06:51:59.290670+00:00 Debian Importer Affected by VCID-bdw7-d7up-aaaf None 34.0.1
2024-09-19T03:38:28.934753+00:00 Debian Importer Affected by VCID-hq7h-468r-aaad None 34.0.1
2024-09-19T03:38:20.458054+00:00 Debian Importer Affected by VCID-1n4c-69xu-aaae None 34.0.1
2024-09-19T03:04:41.952199+00:00 Debian Importer Affected by VCID-dymx-8r2e-aaad None 34.0.1
2024-04-25T07:25:36.558793+00:00 Debian Importer Affected by VCID-ttvn-gv7h-aaaq None 34.0.0rc4
2024-04-25T05:15:02.789799+00:00 Debian Importer Affected by VCID-bdw7-d7up-aaaf None 34.0.0rc4
2024-04-25T02:09:18.422537+00:00 Debian Importer Affected by VCID-hq7h-468r-aaad None 34.0.0rc4
2024-04-25T02:09:12.413471+00:00 Debian Importer Affected by VCID-1n4c-69xu-aaae None 34.0.0rc4
2024-04-25T01:25:53.185149+00:00 Debian Importer Affected by VCID-dymx-8r2e-aaad None 34.0.0rc4
2024-04-24T22:20:18.262039+00:00 Debian Importer Affected by VCID-y2w8-eze9-aaar None 34.0.0rc4
2024-01-11T09:21:55.474463+00:00 Debian Importer Affected by VCID-ttvn-gv7h-aaaq None 34.0.0rc2
2024-01-11T06:57:38.468469+00:00 Debian Importer Affected by VCID-bdw7-d7up-aaaf None 34.0.0rc2
2024-01-11T03:12:42.788642+00:00 Debian Importer Affected by VCID-hq7h-468r-aaad None 34.0.0rc2
2024-01-11T03:12:37.935442+00:00 Debian Importer Affected by VCID-1n4c-69xu-aaae None 34.0.0rc2
2024-01-11T02:26:23.943991+00:00 Debian Importer Affected by VCID-dymx-8r2e-aaad None 34.0.0rc2
2024-01-10T23:10:33.417618+00:00 Debian Importer Affected by VCID-y2w8-eze9-aaar None 34.0.0rc2
2024-01-04T19:35:17.018527+00:00 Debian Importer Affected by VCID-ttvn-gv7h-aaaq None 34.0.0rc1
2024-01-04T17:53:15.530258+00:00 Debian Importer Affected by VCID-bdw7-d7up-aaaf None 34.0.0rc1
2024-01-04T15:19:10.271340+00:00 Debian Importer Affected by VCID-hq7h-468r-aaad None 34.0.0rc1
2024-01-04T15:19:06.368291+00:00 Debian Importer Affected by VCID-1n4c-69xu-aaae None 34.0.0rc1
2024-01-04T14:45:39.690110+00:00 Debian Importer Affected by VCID-dymx-8r2e-aaad None 34.0.0rc1
2024-01-04T12:16:07.290945+00:00 Debian Importer Affected by VCID-y2w8-eze9-aaar None 34.0.0rc1