-------- Forwarded Message -------- Subject: [Security-announce][CVE-2026-15806] urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme Date: Tue, 18 Aug 2026 15:38:30 +0000 From: Kirill Podoprigora via Security-announce <security-announce () python org> Reply-To: security-sig () python org To: security-announce () python org CC: Kirill Podoprigora <kirill.bast () gmail com>

There is a MEDIUM severity vulnerability affecting CPython.

The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://.

Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication.

Users who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs.

Please see the linked CVE ID for the latest information on affected versions: - https://www.cve.org/CVERecord?id=CVE-2026-15806 - https://github.com/python/cpython/pull/155696

Security-announce mailing list -- security-announce () python org https://mail.python.org/mailman3//lists/security-announce.python.org

-------- Forwarded Message -------- Date: Tue, 18 Aug 2026 13:55:39 +0000 From: Seth Larson <seth () python org> Reply-To: security-sig () python org To: security-announce () python org

There is a MEDIUM severity vulnerability affecting CPython. Please see the linked CVE ID for the latest information on affected versions:

https://www.cve.org/CVERecord?id=CVE-2026-17084 https://github.com/python/cpython/pull/155293

Security-announce mailing list -- security-announce () python org To unsubscribe send an email to security-announce-leave () python org https://mail.python.org/mailman3//lists/security-announce.python.org

Lupa integrates the runtimes of Lua or LuaJIT2 into CPython. In 2.6 and earlier, attributefilter is not consistently applied when attributes are accessed through built-in functions like getattr and setattr. This allows an attacker to bypass the intended restrictions and eventually achieve arbitrary code execution.

There is a MEDIUM severity vulnerability affecting CPython.

Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.

A vulnerability was found in PyLongFromString() in Python, which is used by int("text"). For non-binary bases it uses an algorithm with quadratic time complexity to convert a string into an arbitrary precision number. It takes about 50ms to parse an int string with 100,000 digits and about 5sec for 1,000,000 digits. The float type, decimal type, int.frombytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected.

There is a defect in the CPython standard library module “mimetypes” where on Windows the default list of known file locations are writable meaning other users can create invalid files to cause MemoryError to be raised on Python runtime startup or have file extensions be interpreted as the incorrect file type.

This defect is caused by the default locations of Linux and macOS platforms (such as “/etc/mime.types”) also being used on Windows, where they are user-writable locations (“C:\etc\mime.types”).

To work-around this issue a user can call mimetypes.init() with an empty list (“[]”) on Windows platforms to avoid using the default list of known file locations.

Impact Via a type confusion bug in the CPython interpreter when using try/except RestrictedPython could be bypassed.

We believe this should be fixed upstream in Python itself until that we remove support for try/except from RestrictedPython. (It has been fixed for some Python versions.)

Patches Patched in version 8.0 by removing support for try/except clauses

Workarounds There is no workaround.

References none

There is a HIGH severity vulnerability affecting the CPython "zipfile" module.

When iterating over names of entries in a zip archive (for example, methods of "zipfile.ZipFile" like "namelist()", "iterdir()", "extractall()", etc) the process can be put into an infinite loop with a maliciously crafted zip archive. This defect applies when reading only metadata or extracting the contents of the zip archive. Programs that are not handling user-controlled zip archives are not affected.

End of life: 10/7/2024, End of support: 5/3/2021, Latest version: 3.8.20

End of life: 10/7/2024, End of support: 5/3/2021, Latest version: 3.8.20

Description of problem:

A security flaw was discovered in the Python generic FAQ wizard moving tool (move-faqwiz.sh).

Relevant part of the code:

28 cutnpad $1 2 suffix1 29 cutnpad $2 1 prefix2 30 cutnpad $2 2 suffix2 31 tmpfile=tmp$RANDOM.tmp 32 file1=faq$prefix1.$suffix1.htp 33 file2=faq$prefix2.$suffix2.htp

Description:

An attacker could in advance create a symbolic link pointing to tmpXXXXX.tmp (the output produced by $RANDOM is only 5 digits long), then run the Python generic FAQ wizard moving tool which would allow him to erase / truncate the target of the symbolic link to zero size.

References:

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=498899

Multiple integer overflows in the PyOSvsnprintf function in Python/mysnprintf.c in Python 2.5.2 and earlier allow context-dependent attackers to cause a denial of service (memory corruption) or have unspecified other impact via crafted input to string formatting operations. NOTE: the handling of certain integer values is also affected by related integer underflows and an off-by-one error.

Description of problem:

Added checks for integer overflows, contributed by Google. Some are only available if asserts are left in the code, in cases where they can't be triggered from Python code.

Proposed upstream patch:

http://svn.python.org/view?rev=60793&view=rev

Integer overflow in hashopenssl.c in the hashlib module in Python 2.5.2 and earlier might allow context-dependent attackers to defeat cryptographic digests, related to "partial hashlib hashing of data exceeding 4GB."

Multiple integer overflows in Python 2.5.2 and earlier allow context-dependent attackers to have an unknown impact via vectors related to the (1) stringobject, (2) unicodeobject, (3) bufferobject, (4) longobject, (5) tupleobject, (6) stropmodule, (7) gcmodule, and (8) mmapmodule modules. NOTE: The expandtabs integer overflows in stringobject and unicodeobject in 2.5.2 are covered by CVE-2008-5031.

Multiple integer overflows in imageop.c in Python before 2.5.3 allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted images that trigger heap-based buffer overflows. NOTE: this issue is due to an incomplete fix for CVE-2007-4965.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.Security Fix(es): python-pymysql: SQL injection if used with untrusted JSON input (CVE-2024-36039) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Untrusted search path vulnerability in the Python module of xchat allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to an erroneous setting of sys.path by the PySysSetArgv function.

References (test case, PoC): http://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.html

Proposed patch: The Debian patch for similar dia's Python related issue, available at:

http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=pythonpath.diff;att=1;bug=504251

should be sufficient to resolve this issue.

Untrusted search path vulnerability in dia's Python plug-in alows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to an erroneous setting of sys.path by the PySysSetArgv function.

References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504251

Test case and more discussion about this issue (and reason's why it can't be fixed in Python is available at): http://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.html

Proposed patch: http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=pythonpath.diff;att=1;bug=504251

End of life: 6/27/2023, End of support: 6/27/2020, Latest version: 3.7.17

End of life: 6/27/2023, End of support: 6/27/2020, Latest version: 3.7.17

End of life: 12/23/2021, End of support: 12/24/2018, Latest version: 3.6.15

End of life: 12/23/2021, End of support: 12/24/2018, Latest version: 3.6.15

End of life: 9/30/2020, Latest version: 3.5.10

End of life: 9/30/2020, Latest version: 3.5.10