tarfile hardlink fallback ignores custom extraction filter rejection via None
-------- Forwarded Message -------- Subject: [Security-announce][CVE-2026-15806] urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme Date: Tue, 18 Aug 2026 15:38:30 +0000 From: Kirill Podoprigora via Security-announce <security-announce () python org> Reply-To: security-sig () python org To: security-announce () python org CC: Kirill Podoprigora <kirill.bast () gmail com>
There is a MEDIUM severity vulnerability affecting CPython.
The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://.
Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication.
Users who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs.
Please see the linked CVE ID for the latest information on affected versions: - https://www.cve.org/CVERecord?id=CVE-2026-15806 - https://github.com/python/cpython/pull/155696
Security-announce mailing list -- security-announce () python org https://mail.python.org/mailman3//lists/security-announce.python.org
-------- Forwarded Message -------- Date: Tue, 18 Aug 2026 13:55:39 +0000 From: Seth Larson <seth () python org> Reply-To: security-sig () python org To: security-announce () python org
There is a MEDIUM severity vulnerability affecting CPython. Please see the linked CVE ID for the latest information on affected versions:
https://www.cve.org/CVERecord?id=CVE-2026-17084 https://github.com/python/cpython/pull/155293
Security-announce mailing list -- security-announce () python org To unsubscribe send an email to security-announce-leave () python org https://mail.python.org/mailman3//lists/security-announce.python.org
Lupa integrates the runtimes of Lua or LuaJIT2 into CPython. In 2.6 and earlier, attributefilter is not consistently applied when attributes are accessed through built-in functions like getattr and setattr. This allows an attacker to bypass the intended restrictions and eventually achieve arbitrary code execution.
Impact Via a type confusion bug in the CPython interpreter when using try/except RestrictedPython could be bypassed.
We believe this should be fixed upstream in Python itself until that we remove support for try/except from RestrictedPython. (It has been fixed for some Python versions.)
Patches Patched in version 8.0 by removing support for try/except clauses
Workarounds There is no workaround.
References none
End of life: 10/7/2024, End of support: 5/3/2021, Latest version: 3.8.20
End of life: 10/7/2024, End of support: 5/3/2021, Latest version: 3.8.20
There is a MEDIUM severity vulnerability affecting CPython.
Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.
There is a HIGH severity vulnerability affecting the CPython "zipfile" module.
When iterating over names of entries in a zip archive (for example, methods of "zipfile.ZipFile" like "namelist()", "iterdir()", "extractall()", etc) the process can be put into an infinite loop with a maliciously crafted zip archive. This defect applies when reading only metadata or extracting the contents of the zip archive. Programs that are not handling user-controlled zip archives are not affected.
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.Security Fix(es): python-pymysql: SQL injection if used with untrusted JSON input (CVE-2024-36039) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A vulnerability was found in PyLongFromString() in Python, which is used by int("text"). For non-binary bases it uses an algorithm with quadratic time complexity to convert a string into an arbitrary precision number. It takes about 50ms to parse an int string with 100,000 digits and about 5sec for 1,000,000 digits. The float type, decimal type, int.frombytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected.
End of life: 6/27/2023, End of support: 6/27/2020, Latest version: 3.7.17
End of life: 6/27/2023, End of support: 6/27/2020, Latest version: 3.7.17
End of life: 12/23/2021, End of support: 12/24/2018, Latest version: 3.6.15
End of life: 12/23/2021, End of support: 12/24/2018, Latest version: 3.6.15
End of life: 9/30/2020, Latest version: 3.5.10
End of life: 9/30/2020, Latest version: 3.5.10
End of life: 3/18/2019, Latest version: 3.4.10
End of life: 3/18/2019, Latest version: 3.4.10
End of life: 9/29/2017, Latest version: 3.3.7
End of life: 9/29/2017, Latest version: 3.3.7
End of life: 2/20/2016, Latest version: 3.2.6
End of life: 2/20/2016, Latest version: 3.2.6
End of life: 1/1/2020, Latest version: 2.7.18
End of life: 1/1/2020, Latest version: 2.7.18