Debian Pypy3 vulnerabilities

CVE-2022-37454 [CRITICAL] CVE-2022-37454: php7.4 - The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer ove... The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface. Scope: local bullseye: resolved (fixed in 7.4.33-1+deb11u1)

CVE-2025-4517 [CRITICAL] CVE-2025-4517: jython - Allows arbitrary filesystem writes outside the extraction directory during extra... Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data". You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile extraction filters documentation ht

CVE-2023-24329 [HIGH] CVE-2023-24329: pypy3 - An issue in the urllib.parse component of Python before 3.11.4 allows attackers ... An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters. Scope: local bookworm: resolved (fixed in 7.3.11+dfsg-2+deb12u2) bullseye: resolved (fixed in 7.3.5+dfsg-2+deb11u3) forky: resolved (fixed in 7.3.12+dfsg-1) sid: resolved (fixed in 7.3.12+dfsg-1) trixie: r

CVE-2021-29921 [CRITICAL] CVE-2021-29921: pypy3 - In Python before 3,9,5, the ipaddress library mishandles leading zero characters... In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses. Scope: local bookworm: resolved (fixed in 7.3.8+dfsg-1) bullseye: resolved forky: resolved (fixed in 7.3.8+dfsg-1) sid: resolved (fixed in 7.3.8+df

CVE-2022-48565 [CRITICAL] CVE-2022-48565: pypy3 - An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The p... An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities. Scope: local bookworm: resolved (fixed in 7.3.5+dfsg-2) bullseye: resolved (fixed in 7.3.5+dfsg-2) forky: resolved (fixed in 7.3.5+dfsg-2) sid: resolved (fixed in 7.3.5+dfsg-2) trixie:

CVE-2021-23336 [MEDIUM] CVE-2021-23336: pypy3 - The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.1... The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a diff

CVE-2020-27619 [CRITICAL] CVE-2020-27619: pypy3 - In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec test... In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP. Scope: local bookworm: resolved (fixed in 7.3.5+dfsg-2) bullseye: resolved (fixed in 7.3.5+dfsg-2) forky: resolved (fixed in 7.3.5+dfsg-2) sid: resolved (fixed in 7.3.5+dfsg-2) trixie: resolved (fixed in 7.3.5+dfsg-2)

CVE-2022-0391 [HIGH] CVE-2022-0391: pypy3 - A flaw was found in Python, specifically within the urllib.parse module. This mo... A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw a

CVE-2015-20107 [HIGH] CVE-2015-20107: pypy3 - In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape cha... In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9

CVE-2021-3737 [HIGH] CVE-2021-3737: pypy3 - A flaw was found in python. An improperly handled HTTP response in the HTTP clie... A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability. Scope: local bookworm: resolved (fixed in 7.3.8+dfsg-1) bullseye: resolved

CVE-2020-26116 [HIGH] CVE-2020-26116: pypy3 - http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9... http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request. Scope: local bookworm: resolved (fixed in 7.3.3+dfsg-1) bullseye: resolved (fixed in 7

CVE-2024-8088 [HIGH] CVE-2024-8088: pypy3 - There is a HIGH severity vulnerability affecting the CPython "zipfile" module af... There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class is unaffected. When iterating over names of entries in a zip archive (for example, methods of "zipfile.Path" like "namelist()", "iterdir()", etc) the process can be put into an infinite loop with a maliciously craf

CVE-2025-4138 [HIGH] CVE-2025-4138: jython - Allows the extraction filter to be ignored, allowing symlink targets to point ou... Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See

CVE-2025-4330 [HIGH] CVE-2025-4330: jython - Allows the extraction filter to be ignored, allowing symlink targets to point ou... Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See

CVE-2020-10735 [HIGH] CVE-2020-10735: pypy3 - A flaw was found in python. In algorithms with quadratic time complexity using n... A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to sys

CVE-2025-13836 [MEDIUM] CVE-2025-13836: pypy3 - When reading an HTTP response from a server, if no read amount is specified, the... When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS. Scope: local bookworm: open bullseye: resolved forky: open sid: open trixie: open

CVE-2022-42919 [HIGH] CVE-2022-42919: pypy3 - Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privil... Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non-default configuration. The Python multiprocessing library, when used with the forkserver start method on Linux, allows pickles to be deserialized from any user in the same machine local network namespace, which in many system configurations means any user on the sam

CVE-2022-45061 [HIGH] CVE-2022-45061: pypy3 - An issue was discovered in Python before 3.11.1. An unnecessary quadratic algori... An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor;

CVE-2024-9287 [MEDIUM] CVE-2024-9287: pypy3 - A vulnerability has been found in the CPython `venv` module and CLI where path n... A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This means that attacker-controlled virtual environments are able to run commands when the virt

CVE-2024-4032 [HIGH] CVE-2024-4032: pypy3 - The “ipaddress” module contained incorrect information about whether certain IPv... The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the is_private and is_global properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network classes, where values wouldn’t be returned in accordance with