Debian Pypy3 vulnerabilities

CVE-2023-6597 [HIGH] CVE-2023-6597: pypy3 - An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting ... An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference symlinks during cleanup of permissions-related errors. This means users which can run privileged programs are potentially able to modify permissions of files referenced by

CVE-2026-4224 [MEDIUM] CVE-2026-4224: pypy3 - When an Expat parser with a registered ElementDeclHandler parses an inline docum... When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs. Scope: local bookworm: open bullseye: open forky: open sid: open trixie: open

CVE-2024-0397 [HIGH] CVE-2024-0397: pypy3 - A defect was discovered in the Python “ssl” module where there is a memory race ... A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at the same time as certificates are loaded into the SSLContext, such as during the TLS handshake with a certificate directory configured. This i

CVE-2025-4435 [HIGH] CVE-2025-4435: jython - When using a TarFile.errorlevel = 0 and extracting with a filter the documented ... When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior is that any filtered members would be skipped and not extracted. However the actual behavior of TarFile.errorlevel = 0 in affected versions is that the member would still be extracted and not skipped. Scope: local bookworm: resolved bullseye: resolved forky: resolved sid: resolved

CVE-2019-20907 [HIGH] CVE-2019-20907: pypy3 - In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR ar... In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation. Scope: local bookworm: resolved (fixed in 7.3.3+dfsg-1) bullseye: resolved (fixed in 7.3.3+dfsg-1) forky: resolved (fixed in 7.3.3+dfsg-1) sid: resolved (fixed in 7.3.3+dfsg-1) trixie:

CVE-2024-7592 [HIGH] CVE-2024-7592: pypy3 - There is a LOW severity vulnerability affecting CPython, specifically the 'http.... There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used while parsing the value. Scope: local bookworm: open bullseye

CVE-2024-6232 [HIGH] CVE-2024-6232: pypy3 - There is a MEDIUM severity vulnerability affecting CPython. Regular express... There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives. Scope: local bookworm: open bullseye: resolved (fixed in 7.3.5+dfsg-2+deb11u5) forky: resolved (fixed in 7.3.18+dfsg-1) sid: resolved (fixed in 7.3.18+dfsg

CVE-2025-8194 [HIGH] CVE-2025-8194: pypy3 - There is a defect in the CPython “tarfile” module affecting the “TarFile” extrac... There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives. This vulnerability can be mitigated by including the following patch afte

CVE-2021-3733 [MEDIUM] CVE-2021-3733: pypy3 - There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who contr... There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw pos

CVE-2025-69534 [HIGH] CVE-2025-69534: pypy3 - Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like se... Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing. Because Python-Markdown does not catch this exception, any application that processes attacker-controlled Markdown may crash. This enables remote, unauthenticated Denial of Service in web

CVE-2020-29651 [HIGH] CVE-2020-29651: pypy3 - A denial of service via regular expression in the py.path.svnwc component of py ... A denial of service via regular expression in the py.path.svnwc component of py (aka python-py) through 1.9.0 could be used by attackers to cause a compute-time denial of service attack by supplying malicious input to the blame functionality. Scope: local bullseye: resolved (fixed in 7.3.5+dfsg-2+deb11u4)

CVE-2021-28861 [HIGH] CVE-2021-28861: pypy3 - Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server... Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states "Warning: http.server is not recommended for production. It only implements b

CVE-2024-5642 [CRITICAL] CVE-2024-5642: pypy3 - CPython 3.9 and earlier doesn't disallow configuring an empty list ("[]") for SS... CPython 3.9 and earlier doesn't disallow configuring an empty list ("[]") for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vulnerability is of low severity due to NPN being not widely used and specifying an empty list likely being unc

CVE-2026-1299 [MEDIUM] CVE-2026-1299: pypy3 - The email module, specifically the "BytesGenerator" class, didn’t properly quot... The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized. This is only applicable if using "LiteralHeader" writing headers that don't respect email folding rules, the new behavior will reject the incorrectly folded headers in "

CVE-2025-15282 [MEDIUM] CVE-2025-15282: pypy3 - User-controlled data URLs parsed by urllib.request.DataHandler allow injecting h... User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype. Scope: local bookworm: open bullseye: open forky: open sid: open trixie: open

CVE-2026-0672 [MEDIUM] CVE-2026-0672: pypy3 - When using http.cookies.Morsel, user-controlled cookie values and parameters can... When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters. Scope: local bookworm: open bullseye: open forky: open sid: open trixie: open

CVE-2025-15366 [MEDIUM] CVE-2025-15366: jython - The imaplib module, when passed a user-controlled command, can have additional c... The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters. Scope: local bookworm: open bullseye: open forky: open sid: open trixie: open

CVE-2025-15367 [MEDIUM] CVE-2025-15367: jython - The poplib module, when passed a user-controlled command, can have additional co... The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters. Scope: local bookworm: open bullseye: open forky: open sid: open trixie: open

CVE-2025-0938 [MEDIUM] CVE-2025-0938: pypy3 - The Python standard library functions `urllib.parse.urlsplit` and `urlparse` acc... The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential parsing across the Python URL parser and other specification-

CVE-2023-27043 [MEDIUM] CVE-2023-27043: pypy3 - The email module of Python through 3.11.3 incorrectly parses e-mail addresses th... The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g.