dev-lang/python-3.14.8 — Security Advisories

▸ GLSA 202506-07 Python, PyPy: Multiple Vulnerabilities this version unaffected high local and remote 2025-06-12

Multiple vulberabilities have been discovered in Python and PyPy, the worst of which can lead to privilege escalation.

Announced: 2025-06-12
Revised: 2025-06-12
Access: local and remote
Bugs: #929045 #937124 #938432 #939206 #945845 #953493 #956682 #957088
Advisory: https://security.gentoo.org/glsa/202506-07

Affected packages

Package	Arch	Vulnerable	Unaffected
dev-lang/pypy	*	< 3.10.7.3.19_p4:3.10, < 3.11.7.3.19_p9:3.11	>= 3.10.7.3.19_p4:3.10, >= 3.11.7.3.19_p9:3.11
dev-lang/python	*	< 3.14.0_beta2:3.14, < 3.13.3_p1:3.13, < 3.12.10_p1:3.12, < 3.11.12_p1:3.11, < 3.10.17_p1:3.10, < 3.9.22_p1:3.9, < 3.8.20_p7:3.8	>= 3.14.0_beta2:3.14, >= 3.13.3_p1:3.13, >= 3.12.10_p1:3.12, >= 3.11.12_p1:3.11, >= 3.10.17_p1:3.10, >= 3.9.22_p1:3.9, >= 3.8.20_p7:3.8

Background

Python is an interpreted, interactive, object-oriented, cross-platform programming language.

Description

Multiple vulnerabilities have been discovered in Python, PyPy3. Please review the CVE identifiers referenced below for details.

Impact

Please review the referenced CVE identifiers for details.

Workaround

There is no known workaround at this time.

Resolution

All Python, PyPy3 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-3.14.0_beta2:3.14"
# emerge --ask --oneshot --verbose ">=dev-lang/python-3.13.3_p1:3.13"
# emerge --ask --oneshot --verbose ">=dev-lang/python-3.12.10_p1:3.12"
# emerge --ask --oneshot --verbose ">=dev-lang/python-3.11.12_p1:3.11"
# emerge --ask --oneshot --verbose ">=dev-lang/python-3.10.17_p1:3.10"
# emerge --ask --oneshot --verbose ">=dev-lang/python-3.9.22_p1:3.9"
# emerge --ask --oneshot --verbose ">=dev-lang/python-3.8.20_p7:3.8"
# emerge --ask --oneshot --verbose ">=dev-lang/pypy-3.10.7.3.19_p4:3.10"
# emerge --ask --oneshot --verbose ">=dev-lang/pypy-3.11.7.3.19_p9:3.11"

References

▸ GLSA 202405-01 Python, PyPy3: Multiple Vulnerabilities version not in range high remote 2024-05-04

Multiple vulberabilities have been discovered in Python and PyPy3, the worst of which can lead to privilege escalation.

Announced: 2024-05-04
Revised: 2024-05-04
Access: remote
Bugs: #884653 #897958 #908018 #912976 #919475 #927299
Advisory: https://security.gentoo.org/glsa/202405-01

Affected packages

Package	Arch	Vulnerable	Unaffected
dev-lang/python	*	< 3.12.1:3.12, < 3.11.8:3.11, < 3.10.14:3.10, < 3.9.19:3.9, < 3.8.19:3.8	>= 3.12.1:3.12, >= 3.11.8:3.11, >= 3.10.14:3.10, >= 3.9.19:3.9, >= 3.8.19:3.8
dev-python/pypy3	*	< 7.3.16	>= 7.3.16
dev-python/pypy3_10	*	< 7.3.16	>= 7.3.16
dev-python/pypy3_9	*	< 7.3.16	>= 7.3.16

Background

Python is an interpreted, interactive, object-oriented, cross-platform programming language.

Description

Multiple vulnerabilities have been discovered in Python, PyPy3. Please review the CVE identifiers referenced below for details.

Impact

Please review the referenced CVE identifiers for details.

Workaround

There is no known workaround at this time.

Resolution

All Python, PyPy3 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-3.12.1:3.12"
# emerge --ask --oneshot --verbose ">=dev-lang/python-3.11.9:3.11"
# emerge --ask --oneshot --verbose ">=dev-lang/python-3.10.14:3.10"
# emerge --ask --oneshot --verbose ">=dev-lang/python-3.9.19:3.9"
# emerge --ask --oneshot --verbose ">=dev-lang/python-3.8.19:3.8"
# emerge --ask --oneshot --verbose ">=dev-python/pypy3-7.3.16"
# emerge --ask --oneshot --verbose ">=dev-python/pypy3_10-7.3.16"
# emerge --ask --oneshot --verbose ">=dev-python/pypy3_9-7.3.16"

References

▸ GLSA 202305-02 Python, PyPy3: Multiple Vulnerabilities version not in range high local and remote 2023-05-03

Multiple vulnerabilities have been found in Python and PyPy, the worst of which could result in arbitrary code execution.

Announced: 2023-05-03
Revised: 2023-05-03
Access: local and remote
Bugs: #880629 #878385 #877851 #876815 #864747 #838250 #835443 #834533 #787260 #811165 #793833
Advisory: https://security.gentoo.org/glsa/202305-02

Affected packages

Package	Arch	Vulnerable	Unaffected
dev-lang/python	*	< 3.8.15_p3:3.8, < 3.9.15_p3:3.9, < 3.10.8_p3:3.10, < 3.11.0_p2:3.11, < 3.12.0_alpha1_p2:12	>= 3.8.15_p3:3.8, >= 3.9.15_p3:3.9, >= 3.10.8_p3:3.10, >= 3.11.0_p2:3.11, >= 3.12.0_alpha1_p2:12
dev-python/pypy3	*	< 7.3.9_p9	>= 7.3.9_p9

Background

Python is an interpreted, interactive, object-oriented, cross-platform programming language.

Description

Multiple vulnerabilities have been discovered in Python and PyPy3. Please review the CVE identifiers referenced below for details.

Impact

Please review the referenced CVE identifiers for details.

Workaround

There is no known workaround at this time.

Resolution

All Python 3.8 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-3.8.15_p3:3.8"

All Python 3.9 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-3.9.15_p3:3.9"

All Python 3.10 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-3.10.8_p3:3.10"

All Python 3.11 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-3.11.0_p2:3.11"

All Python 3.12 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-3.12.0_alpha1_p2"

All PyPy3 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-python/pypy3-7.3.9_p9"

References

▸ GLSA 202104-04 Python: Multiple vulnerabilities version not in range normal local, remote 2021-04-30

Multiple vulnerabilities have been found in Python, the worst of which might allow attackers to access sensitive information.

Announced: 2021-04-30
Revised: 2021-04-30
Access: local, remote
Bugs: #770853 #779841 #779844
Advisory: https://security.gentoo.org/glsa/202104-04

Affected packages

Package	Arch	Vulnerable	Unaffected
dev-lang/python	*	< 3.9.2_p1	>= 2.7.18_p8:2.7, >= 3.6.13_p1:3.6, >= 3.7.10_p1:3.7, >= 3.8.8_p1:3.8, >= 3.9.2_p1:3.9

Background

Python is an interpreted, interactive, object-oriented programming language.

Description

Multiple vulnerabilities have been discovered in Python. Please review the CVE identifiers referenced below for details.

Impact

Please review the referenced CVE identifiers for details.

Workaround

There is no known workaround at this time.

Resolution

All Python 2.7 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-2.7.18_p8"

All Python 3.6 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-3.6.13_p1"

All Python 3.7 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-3.7.10_p1"

All Python 3.8 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-3.8.8_p1"

All Python 3.9 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-3.9.2_p1"

References

▸ GLSA 202101-18 Python: Multiple vulnerabilities version not in range normal remote 2021-01-24

Multiple vulnerabilities have been found in Python, the worst of which could result in the arbitrary execution of code.

Announced: 2021-01-24
Revised: 2021-01-24
Access: remote
Bugs: #749339 #759928 #766189
Advisory: https://security.gentoo.org/glsa/202101-18

Affected packages

Package	Arch	Vulnerable	Unaffected
dev-lang/python	*	< 2.7.18-r6:2.7, < 3.6.12-r2:3.6, < 3.7.9-r2:3.7, < 3.8.7-r1:3.8, < 3.9.1-r1:3.9	>= 2.7.18-r6:2.7, >= 3.6.12-r2:3.6, >= 3.7.9-r2:3.7, >= 3.8.7-r1:3.8, >= 3.9.1-r1:3.9

Background

Python is an interpreted, interactive, object-oriented programming language.

Description

Multiple vulnerabilities have been discovered in Python. Please review the bugs referenced below for details.

Impact

A remote attacker could possibly execute arbitrary code with the privileges of the process, or cause a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All Python 2.7 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-2.7.18-r5"

All Python 3.6 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-3.6.12-r1"

All Python 3.7 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-3.7.9-r1"

All Python 3.8 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-3.8.6-r1"

All Python 3.9 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-3.9.0-r1"

References

▸ GLSA 202008-01 Python: Multiple vulnerabilities version not in range normal remote 2020-08-02

Multiple vulnerabilities have been found in Python, the worst of which could result in a Denial of Service condition.

Announced: 2020-08-02
Revised: 2020-08-02
Access: remote
Bugs: #728668 #732498
Advisory: https://security.gentoo.org/glsa/202008-01

Affected packages

Package	Arch	Vulnerable	Unaffected
dev-lang/python	*	< 2.7.18-r1:2.7, < 3.6.11-r2:3.6, < 3.7.8-r2:3.7, < 3.8.4-r1:3.8	>= 2.7.18-r1:2.7, >= 3.6.11-r2:3.6, >= 3.7.8-r2:3.7, >= 3.8.4-r1:3.8

Background

Python is an interpreted, interactive, object-oriented programming language.

Description

Multiple vulnerabilities have been discovered in Python. Please review the CVE identifiers referenced below for details.

Impact

Please review the referenced CVE identifiers for details.

Workaround

There is no known workaround at this time.

Resolution

All Python 2.7 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-2.7.18-r1"

All Python 3.6 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-3.6.11-r2"

All Python 3.7 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-3.7.8-r2"

All Python 3.8 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-3.8.4-r1"

References

▸ GLSA 202005-09 Python: Denial of service version not in range normal remote 2020-05-14

A vulnerability in Python could lead to a Denial of Service condition.

Announced: 2020-05-14
Revised: 2020-10-18 (revision 2)
Access: remote
Bugs: #707822 #741502
Advisory: https://security.gentoo.org/glsa/202005-09

Affected packages

Package	Arch	Vulnerable	Unaffected
dev-lang/python	*	< 2.7.18-r2:2.7, < 3.6.10-r2:3.6, < 3.7.7-r2:3.7, < 3.8.2-r2:3.8	>= 2.7.18-r2:2.7, >= 3.6.10-r2:3.6, >= 3.7.7-r2:3.7, >= 3.8.2-r2:3.8

Background

Python is an interpreted, interactive, object-oriented programming language.

Description

An issue was discovered in urllib.request.AbstractBasicAuthHandler which allowed a remote attacker to send malicious data causing extensive regular expression backtracking.

Impact

An attacker could cause a possible Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All Python 2.7 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-2.7.18-r2:2.7"

All Python 3.6 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-3.6.10-r2:3.6"

All Python 3.7 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-3.7.7-r2:3.7"

All Python 3.8 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-3.8.2-r2:3.8"

References

CVE-2020-8492

▸ GLSA 202003-26 Python: Multiple vulnerabilities version not in range normal local, remote 2020-03-15

Multiple vulnerabilities have been found in Python, the worst of which could result in a Denial of Service condition.

Announced: 2020-03-15
Revised: 2020-03-15
Access: local, remote
Bugs: #676700 #680246 #680298 #684838 #689822
Advisory: https://security.gentoo.org/glsa/202003-26

Affected packages

Package	Arch	Vulnerable	Unaffected
dev-lang/python	*	< 2.7.17:2.7, < 3.5.7:3.5/3.5m, < 3.6.9:3.6/3.6m, < 3.7.4:3.7/3.7m	>= 2.7.17:2.7, >= 3.5.7:3.5/3.5m, >= 3.6.9:3.6/3.6m, >= 3.7.4:3.7/3.7m

Background

Python is an interpreted, interactive, object-oriented programming language.

Description

Multiple vulnerabilities have been discovered in Python. Please review the CVE identifiers referenced below for details.

Impact

A remote attacker could possibly perform a CRLF injection attack, obtain sensitive information, trick Python into sending cookies to the wrong domain or cause a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All Python 2.7.x users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-2.7.17:2.7"

All Python 3.5.x users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-3.5.7:3.5/3.5m"

All Python 3.6.x users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-3.6.9:3.6/3.6m"

All Python 3.7x users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-3.7.4:3.7/3.7m"

References

▸ GLSA 201811-02 Python: Buffer overflow version not in range normal remote 2018-11-09

A buffer overflow in Python might allow remote attackers to cause a Denial of Service condition.

Announced: 2018-11-09
Revised: 2018-11-09
Access: remote
Bugs: #647862
Advisory: https://security.gentoo.org/glsa/201811-02

Affected packages

Package	Arch	Vulnerable	Unaffected
dev-lang/python	*	< 2.7.15:2.7	>= 2.7.15:2.7

Background

Python is an interpreted, interactive, object-oriented programming language.

Description

A buffer overflow vulnerability have been discovered in Python. Please review the CVE identifiers referenced below for details.

Impact

A remote attacker, in special situations such as function as a service, could violate a trust boundary and cause a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All Python users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-2.7.15:2.7"

References

CVE-2018-1000030

▸ GLSA 201805-02 Python: Buffer overflow version not in range normal remote 2018-05-02

A buffer overflow in Python might allow remote attackers to execute arbitrary code.

Announced: 2018-05-02
Revised: 2018-05-02
Access: remote
Bugs: #637938
Advisory: https://security.gentoo.org/glsa/201805-02

Affected packages

Package	Arch	Vulnerable	Unaffected
dev-lang/python	*	< 2.7.14:2.7	>= 2.7.14:2.7

Background

Python is an interpreted, interactive, object-oriented programming language.

Description

A buffer overflow was discovered in Python’s PyString_DecodeEscape function in stringobject.c.

Impact

Remote attackers, by enticing a user to process a specially crafted file, could execute arbitrary code.

Workaround

There is no known workaround at this time.

Resolution

All Python 2 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-2.7.14:2.7"

References

CVE-2017-1000158

▸ GLSA 201701-18 Python: Multiple vulnerabilities version not in range normal remote 2017-01-10

Multiple vulnerabilities have been found in Python, the worst of which could lead to arbitrary code execution.

Announced: 2017-01-10
Revised: 2017-02-24 (revision 2)
Access: remote
Bugs: #531002 #585910 #585946
Advisory: https://security.gentoo.org/glsa/201701-18

Affected packages

Package	Arch	Vulnerable	Unaffected
dev-lang/python	*	< 3.4.5	>= 2.7.12:2.7, >= 3.4.5:3.4

Background

Python is an interpreted, interactive, object-oriented programming language.

Description

Multiple vulnerabilities have been discovered in Python. Please review the CVE identifiers referenced below for details.

Impact

A remote attacker could entice a user to open a specially crafted index file using Python’s dumbdbm module, possibly resulting in execution of arbitrary code with the privileges of the process.

A remote attacker could entice a user to process a specially crafted input stream using Python’s zipimporter module, possibly allowing attackers to cause unspecified impact.

A man in the middle attacker could strip out the STARTTLS command without generating an exception on the Python SMTP client application, preventing the establishment of the TLS layer.

Workaround

There is no known workaround at this time.

Resolution

All Python 2 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-2.7.12:2.7"

All Python 3 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-3.4.5:3.4"

References

▸ GLSA 201503-10 Python: Multiple vulnerabilities this version unaffected normal local, remote 2015-03-18

Multiple vulnerabilities have been found in Python, the worst of which could lead to arbitrary code execution.

Announced: 2015-03-18
Revised: 2015-06-17 (revision 2)
Access: local, remote
Bugs: #495224 #500518 #505068 #506084 #514686 #523792 #532232
Advisory: https://security.gentoo.org/glsa/201503-10

Affected packages

Package	Arch	Vulnerable	Unaffected
dev-lang/python	*	< 3.3.5-r1	>= 3.3.5-r1, >= 2.7.9-r1

Background

Python is an interpreted, interactive, object-oriented programming language.

Description

Multiple vulnerabilities have been discovered in Python. Please review the CVE identifiers referenced below for details.

Impact

A context-dependent attacker may be able to execute arbitrary code or cause a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All Python 3.3 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-3.3.5-r1"

All Python 2.7 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-2.7.9-r1"

References

▸ GLSA 201401-04 Python: Multiple vulnerabilities this version unaffected normal remote 2014-01-06

Multiple vulnerabilities have been found in Python, the worst of which allow remote attackers to cause a Denial of Service condition.

Announced: 2014-01-06
Revised: 2015-06-17 (revision 5)
Access: remote
Bugs: #325593 #355927 #358663 #396329 #403437 #469988
Advisory: https://security.gentoo.org/glsa/201401-04

Affected packages

Package	Arch	Vulnerable	Unaffected
dev-lang/python	*	< 3.3.2-r1	>= 3.2.5-r1, >= 2.6.8, >= 2.7.3-r1, >= 3.3.2-r1

Background

Python is an interpreted, interactive, object-oriented programming language.

Description

Multiple vulnerabilities have been discovered in Python. Please review the CVE identifiers referenced below for details.

Impact

A remote attacker could possibly cause a Denial of Service condition or perform a man-in-the-middle attack to disclose sensitive information.

Workaround

There is no known workaround at this time.

Resolution

All Python 3.3 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-3.3.2-r1"

All Python 3.2 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-3.2.5-r1"

All Python 2.6 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-2.6.8"

All Python 2.7 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-2.7.3-r1"

References

▸ GLSA 200907-16 Python: Integer overflows this version unaffected normal remote 2009-07-19

Multiple integer overflows in Python have an unspecified impact.

Announced: 2009-07-19
Revised: 2009-07-19
Access: remote
Bugs: #246991
Advisory: https://security.gentoo.org/glsa/200907-16

Affected packages

Package	Arch	Vulnerable	Unaffected
dev-lang/python	*	< 2.5.4-r2	>= 2.5.4-r2, >= 2.4.6 (revision)

Background

Python is an interpreted, interactive, object-oriented programming language.

Description

Chris Evans reported multiple integer overflows in the expandtabs method, as implemented by (1) the string_expandtabs function in Objects/stringobject.c and (2) the unicode_expandtabs function in Objects/unicodeobject.c.

Impact

A remote attacker could exploit these vulnerabilities in Python applications or daemons that pass user-controlled input to vulnerable functions. The security impact is currently unknown but may include the execution of arbitrary code or a Denial of Service.

Workaround

There is no known workaround at this time.

Resolution

All Python 2.5 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-2.5.4-r2"

All Python 2.4 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-2.4.6"

References

CVE-2008-5031

▸ GLSA 200807-16 Python: Multiple vulnerabilities this version unaffected normal remote 2008-07-31

Multiple vulnerabilities in Python may allow for the execution of arbitrary code.

Announced: 2008-07-31
Revised: 2009-07-19 (revision 2)
Access: remote
Bugs: #230640 #232137
Advisory: https://security.gentoo.org/glsa/200807-16

Affected packages

Package	Arch	Vulnerable	Unaffected
dev-lang/python	*	< 2.5.2-r6	>= 2.4.4-r14 (revision), >= 2.5.2-r6, >= 2.4.6 (revision)

Background

Python is an interpreted, interactive, object-oriented programming language.

Description

Multiple vulnerabilities were discovered in Python:

David Remahl of Apple Product Security reported several integer overflows in core modules such as stringobject, unicodeobject, bufferobject, longobject, tupleobject, stropmodule, gcmodule, mmapmodule (CVE-2008-2315).
David Remahl of Apple Product Security also reported an integer overflow in the hashlib module, leading to unreliable cryptographic digest results (CVE-2008-2316).
Justin Ferguson reported multiple buffer overflows in unicode string processing that only affect 32bit systems (CVE-2008-3142).
The Google Security Team reported multiple integer overflows (CVE-2008-3143).
Justin Ferguson reported multiple integer underflows and overflows in the PyOS_vsnprintf() function, and an off-by-one error when passing zero-length strings, leading to memory corruption (CVE-2008-3144).

Impact

A remote attacker could exploit these vulnerabilities in Python applications or daemons that pass user-controlled input to vulnerable functions. Exploitation might lead to the execution of arbitrary code or a Denial of Service. Vulnerabilities within the hashlib might lead to weakened cryptographic protection of data integrity or authenticity.

Workaround

There is no known workaround at this time.

Resolution

All Python 2.4 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-2.4.4-r14"

All Python 2.5 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-2.5.2-r6"

Please note that Python 2.3 is masked since June 24, and we will not be releasing updates to it. It will be removed from the tree in the near future.

References

▸ GLSA 200807-01 Python: Multiple integer overflows this version unaffected normal remote 2008-07-01

Multiple integer overflows may allow for Denial of Service.

Announced: 2008-07-01
Revised: 2008-07-01
Access: remote
Bugs: #216673 #217221
Advisory: https://security.gentoo.org/glsa/200807-01

Affected packages

Package	Arch	Vulnerable	Unaffected
dev-lang/python	*	< 2.4.4-r13	>= 2.3.6-r6 (revision), >= 2.4.4-r13

Background

Python is an interpreted, interactive, object-oriented programming language.

Description

Multiple vulnerabilities were discovered in Python:

David Remahl reported multiple integer overflows in the file imageop.c, leading to a heap-based buffer overflow (CVE-2008-1679). This issue is due to an incomplete fix for CVE-2007-4965.
Justin Ferguson discovered that an integer signedness error in the zlib extension module might trigger insufficient memory allocation and a buffer overflow via a negative signed integer (CVE-2008-1721).
Justin Ferguson discovered that insufficient input validation in the PyString_FromStringAndSize() function might lead to a buffer overflow (CVE-2008-1887).

Impact

A remote attacker could exploit these vulnerabilities to cause a Denial of Service or possibly the remote execution of arbitrary code with the privileges of the user running Python.

Workaround

There is no known workaround at this time.

Resolution

The imageop module is no longer built in the unaffected versions.

All Python 2.3 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-2.3.6-r6"

All Python 2.4 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-2.4.4-r13"

References

▸ GLSA 200802-10 Python: PCRE Integer overflow this version unaffected normal remote 2008-02-23

A vulnerability within Python's copy of PCRE might lead to the execution of arbitrary code.

Announced: 2008-02-23
Revised: 2008-02-23
Access: remote
Bugs: #198373
Advisory: https://security.gentoo.org/glsa/200802-10

Affected packages

Package	Arch	Vulnerable	Unaffected
dev-lang/python	*	< 2.3.6-r4	>= 2.3.6-r4

Background

Python is an interpreted, interactive, object-oriented programming language.

Description

Python 2.3 includes a copy of PCRE which is vulnerable to an integer overflow vulnerability, leading to a buffer overflow.

Impact

An attacker could exploit the vulnerability by tricking a vulnerable Python application to compile a regular expressions, which could possibly lead to the execution of arbitrary code, a Denial of Service or the disclosure of sensitive information.

Workaround

There is no known workaround at this time.

Resolution

All Python 2.3 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-2.3.6-r4"

References

▸ GLSA 200711-07 Python: User-assisted execution of arbitrary code this version unaffected normal remote 2007-11-07

Multiple integer overflow vulnerabilities have been discovered in Python, possibly resulting in the execution of arbitrary code or a Denial of Service.

Announced: 2007-11-07
Revised: 2007-11-07
Access: remote
Bugs: #192876
Advisory: https://security.gentoo.org/glsa/200711-07

Affected packages

Package	Arch	Vulnerable	Unaffected
dev-lang/python	*	< 2.4.4-r6	>= 2.3.6-r3 (revision), >= 2.4.4-r6

Background

Python is an interpreted, interactive, object-oriented programming language.

Description

Slythers Bro discovered multiple integer overflows in the imageop module, one of them in the tovideo() method, in various locations in files imageop.c, rbgimgmodule.c, and also in other files.

Impact

A remote attacker could entice a user to process specially crafted images with an application using the Python imageop module, resulting in the execution of arbitrary code with the privileges of the user running the application, or a Denial of Service. Note that this vulnerability may or may not be exploitable, depending on the application using the module.

Workaround

There is no known workaround at this time.

Resolution

All Python 2.3.x users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-2.3.6-r3"

All Python 2.4.x users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-2.4.4-r6"

References

CVE-2007-4965

▸ GLSA 200610-07 Python: Buffer Overflow this version unaffected normal remote 2006-10-17

A buffer overflow in Python's "repr()" function can be exploited to cause a Denial of Service and potentially allows the execution of arbitrary code.

Announced: 2006-10-17
Revised: 2007-02-26 (revision 3)
Access: remote
Bugs: #149065
Advisory: https://security.gentoo.org/glsa/200610-07

Affected packages

Package	Arch	Vulnerable	Unaffected
dev-lang/python	*	< 2.4.3-r4	>= 2.4.3-r4, >= 2.3.5-r3 (revision), >= 2.3.6 (revision)

Background

Python is an interpreted, interactive, object-oriented, cross-platform programming language.

Description

Benjamin C. Wiley Sittler discovered a buffer overflow in Python's "repr()" function when handling UTF-32/UCS-4 encoded strings.

Impact

If a Python application processes attacker-supplied data with the "repr()" function, this could potentially lead to the execution of arbitrary code with the privileges of the affected application or a Denial of Service.

Workaround

There is no known workaround at this time.

Resolution

All Python users should update to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-2.4.3-r4"

References

CVE-2006-4980

▸ GLSA 200509-08 Python: Heap overflow in the included PCRE library this version unaffected normal remote 2005-09-12

The "re" Python module is vulnerable to a heap overflow, possibly leading to the execution of arbitrary code.

Announced: 2005-09-12
Revised: 2005-09-12
Access: remote
Bugs: #104009
Advisory: https://security.gentoo.org/glsa/200509-08

Affected packages

Package	Arch	Vulnerable	Unaffected
dev-lang/python	*	< 2.3.5-r2	>= 2.3.5-r2

Background

Python is an interpreted, interactive, object-oriented, cross-platform programming language. The "re" Python module provides regular expression functions.

Description

The "re" Python module makes use of a private copy of libpcre which is subject to an integer overflow leading to a heap overflow (see GLSA 200508-17).

Impact

An attacker could target a Python-based web application (or SUID application) that would use untrusted data as regular expressions, potentially resulting in the execution of arbitrary code (or privilege escalation).

Workaround

Python users that don't run any Python web application or SUID application (or that run one that wouldn't use untrusted inputs as regular expressions) are not affected by this issue.

Resolution

All Python users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-2.3.5-r2"

References

▸ GLSA 200502-09 Python: Arbitrary code execution through SimpleXMLRPCServer this version unaffected high remote 2005-02-08

Python-based XML-RPC servers may be vulnerable to remote execution of arbitrary code.

Announced: 2005-02-08
Revised: 2005-02-08
Access: remote
Bugs: #80592
Advisory: https://security.gentoo.org/glsa/200502-09

Affected packages

Package	Arch	Vulnerable	Unaffected
dev-lang/python	*	<= 2.3.4	>= 2.3.4-r1, >= 2.3.3-r2 (revision), >= 2.2.3-r6 (revision)

Background

Python is an interpreted, interactive, object-oriented, cross-platform programming language.

Description

Graham Dumpleton discovered that XML-RPC servers making use of the SimpleXMLRPCServer library that use the register_instance() method to register an object without a _dispatch() method are vulnerable to a flaw allowing to read or modify globals of the associated module.

Impact

A remote attacker may be able to exploit the flaw in such XML-RPC servers to execute arbitrary code on the server host with the rights of the XML-RPC server.

Workaround

Python users that don't make use of any SimpleXMLRPCServer-based XML-RPC servers, or making use of servers using only the register_function() method are not affected.

Resolution

All Python users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose dev-lang/python

References

▸ GLSA 200409-03 Python 2.2: Buffer overflow in getaddrinfo() this version unaffected high remote 2004-09-02

Python 2.2 has a vulnerability in DNS handling when IPV6 is disabled and a malformed IPV6 address is encountered by getaddrinfo().

Announced: 2004-09-02
Revised: 2004-09-02
Access: remote
Bugs: #62440
Advisory: https://security.gentoo.org/glsa/200409-03

Affected packages

Package	Arch	Vulnerable	Unaffected
dev-lang/python	*	< 2.2.2	>= 2.2.2, < 2.2

Background

Python is an interpreted, interactive, object-oriented, cross-platform programming language.

Description

If IPV6 is disabled in Python 2.2, getaddrinfo() is not able to handle IPV6 DNS requests properly and a buffer overflow occurs.

Impact

An attacker can execute arbitrary code as the user running python.

Workaround

Users with IPV6 enabled are not affected by this vulnerability.

Resolution

All Python 2.2 users should upgrade to the latest version:

# emerge sync

# emerge -pv ">=dev-lang/python-2.2.2"
# emerge ">=dev-lang/python-2.2.2"