[Git][security-tracker-team/security-tracker][master] Update upstream tags for some python issues
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Fri Jun 6 20:50:59 BST 2025
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
e1460ccd by Salvatore Bonaccorso at 2025-06-06T21:50:25+02:00
Update upstream tags for some python issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -780,8 +780,8 @@ CVE-2025-4517 (Allows arbitrary filesystem writes outside the extraction directo
NOTE: https://mail.python.org/archives/list/security-announce@python.org/thread/MAXIJJCUUMCL7ATZNDVEGGHUMQMUUKLG/
NOTE: Fixed by: https://github.com/python/cpython/commit/3612d8f51741b11f36f8fb0494d79086bac9390a (main)
NOTE: Fixed by: https://github.com/python/cpython/commit/9e0ac76d96cf80b49055f6d6b9a6763fb9215c2a (3.14)
- NOTE: Fixed by: https://github.com/python/cpython/commit/aa9eb5f757ceff461e6e996f12c89e5d9b583b01 (3.13.4)
- NOTE: Fixed by: https://github.com/python/cpython/commit/19de092debb3d7e832e5672cc2f7b788d35951da (3.12.11)
+ NOTE: Fixed by: https://github.com/python/cpython/commit/aa9eb5f757ceff461e6e996f12c89e5d9b583b01 (v3.13.4)
+ NOTE: Fixed by: https://github.com/python/cpython/commit/19de092debb3d7e832e5672cc2f7b788d35951da (v3.12.11)
NOTE: Got backported to 3.9 in https://github.com/python/cpython/commit/98016f7c92aa4c1232c68bac1ed6646db31782ec (v3.9.17)
NOTE: Got backported to 3.11 in https://github.com/python/cpython/commit/241f2e54a6a2801a1d2022f0fa56309e124866c3 (v3.11.4)
CVE-2025-4435 (When using a TarFile.errorlevel = 0and extracting with a filter the do ...)
@@ -797,8 +797,8 @@ CVE-2025-4435 (When using a TarFile.errorlevel = 0and extracting with a filter t
NOTE: https://mail.python.org/archives/list/security-announce@python.org/thread/MAXIJJCUUMCL7ATZNDVEGGHUMQMUUKLG/
NOTE: Fixed by: https://github.com/python/cpython/commit/3612d8f51741b11f36f8fb0494d79086bac9390a (main)
NOTE: Fixed by: https://github.com/python/cpython/commit/9e0ac76d96cf80b49055f6d6b9a6763fb9215c2a (3.14)
- NOTE: Fixed by: https://github.com/python/cpython/commit/aa9eb5f757ceff461e6e996f12c89e5d9b583b01 (3.13.4)
- NOTE: Fixed by: https://github.com/python/cpython/commit/19de092debb3d7e832e5672cc2f7b788d35951da (3.12.11)
+ NOTE: Fixed by: https://github.com/python/cpython/commit/aa9eb5f757ceff461e6e996f12c89e5d9b583b01 (v3.13.4)
+ NOTE: Fixed by: https://github.com/python/cpython/commit/19de092debb3d7e832e5672cc2f7b788d35951da (v3.12.11)
NOTE: Got backported to 3.9 in https://github.com/python/cpython/commit/98016f7c92aa4c1232c68bac1ed6646db31782ec (v3.9.17)
NOTE: Got backported to 3.11 in https://github.com/python/cpython/commit/241f2e54a6a2801a1d2022f0fa56309e124866c3 (v3.11.4)
CVE-2025-4420 (The Vayu Blocks \u2013 Gutenberg Blocks for WordPress & WooCommerce pl ...)
@@ -818,8 +818,8 @@ CVE-2025-4330 (Allows the extraction filter to be ignored, allowing symlink targ
NOTE: https://mail.python.org/archives/list/security-announce@python.org/thread/MAXIJJCUUMCL7ATZNDVEGGHUMQMUUKLG/
NOTE: Fixed by: https://github.com/python/cpython/commit/3612d8f51741b11f36f8fb0494d79086bac9390a (main)
NOTE: Fixed by: https://github.com/python/cpython/commit/9e0ac76d96cf80b49055f6d6b9a6763fb9215c2a (3.14)
- NOTE: Fixed by: https://github.com/python/cpython/commit/aa9eb5f757ceff461e6e996f12c89e5d9b583b01 (3.13.4)
- NOTE: Fixed by: https://github.com/python/cpython/commit/19de092debb3d7e832e5672cc2f7b788d35951da (3.12.11)
+ NOTE: Fixed by: https://github.com/python/cpython/commit/aa9eb5f757ceff461e6e996f12c89e5d9b583b01 (v3.13.4)
+ NOTE: Fixed by: https://github.com/python/cpython/commit/19de092debb3d7e832e5672cc2f7b788d35951da (v3.12.11)
NOTE: Got backported to 3.9 in https://github.com/python/cpython/commit/98016f7c92aa4c1232c68bac1ed6646db31782ec (v3.9.17)
NOTE: Got backported to 3.11 in https://github.com/python/cpython/commit/241f2e54a6a2801a1d2022f0fa56309e124866c3 (v3.11.4)
CVE-2025-4205 (The Popup Maker plugin for WordPress is vulnerable to Stored Cross-Sit ...)
@@ -837,8 +837,8 @@ CVE-2025-4138 (Allows the extraction filter to be ignored, allowing symlink targ
NOTE: https://mail.python.org/archives/list/security-announce@python.org/thread/MAXIJJCUUMCL7ATZNDVEGGHUMQMUUKLG/
NOTE: Fixed by: https://github.com/python/cpython/commit/3612d8f51741b11f36f8fb0494d79086bac9390a (main)
NOTE: Fixed by: https://github.com/python/cpython/commit/9e0ac76d96cf80b49055f6d6b9a6763fb9215c2a (3.14)
- NOTE: Fixed by: https://github.com/python/cpython/commit/aa9eb5f757ceff461e6e996f12c89e5d9b583b01 (3.13.4)
- NOTE: Fixed by: https://github.com/python/cpython/commit/19de092debb3d7e832e5672cc2f7b788d35951da (3.12.11)
+ NOTE: Fixed by: https://github.com/python/cpython/commit/aa9eb5f757ceff461e6e996f12c89e5d9b583b01 (v3.13.4)
+ NOTE: Fixed by: https://github.com/python/cpython/commit/19de092debb3d7e832e5672cc2f7b788d35951da (v3.12.11)
NOTE: Got backported to 3.9 in https://github.com/python/cpython/commit/98016f7c92aa4c1232c68bac1ed6646db31782ec (v3.9.17)
NOTE: Got backported to 3.11 in https://github.com/python/cpython/commit/241f2e54a6a2801a1d2022f0fa56309e124866c3 (v3.11.4)
CVE-2025-48998 (DataEase is an open source business intelligence and data visualizatio ...)
@@ -939,8 +939,8 @@ CVE-2024-12718 (Allows modifying some file metadata (e.g. last modified) with fi
NOTE: https://mail.python.org/archives/list/security-announce@python.org/thread/MAXIJJCUUMCL7ATZNDVEGGHUMQMUUKLG/
NOTE: Fixed by: https://github.com/python/cpython/commit/3612d8f51741b11f36f8fb0494d79086bac9390a (main)
NOTE: Fixed by: https://github.com/python/cpython/commit/9e0ac76d96cf80b49055f6d6b9a6763fb9215c2a (3.14)
- NOTE: Fixed by: https://github.com/python/cpython/commit/aa9eb5f757ceff461e6e996f12c89e5d9b583b01 (3.13.4)
- NOTE: Fixed by: https://github.com/python/cpython/commit/19de092debb3d7e832e5672cc2f7b788d35951da (3.12.11)
+ NOTE: Fixed by: https://github.com/python/cpython/commit/aa9eb5f757ceff461e6e996f12c89e5d9b583b01 (v3.13.4)
+ NOTE: Fixed by: https://github.com/python/cpython/commit/19de092debb3d7e832e5672cc2f7b788d35951da (v3.12.11)
CVE-2024-47081
- requests <unfixed> (bug #1107368)
[bookworm] - requests <postponed> (Minor issue; revisit when fixed upstream)
@@ -5865,8 +5865,8 @@ CVE-2025-4516 (There is an issue in CPython when using `bytes.decode("unicode_es
NOTE: https://github.com/python/cpython/issues/133767
NOTE: https://github.com/python/cpython/pull/129648
NOTE: https://github.com/python/cpython/commit/9f69a58623bd01349a18ba0c7a9cb1dad6a51e8e (main)
- NOTE: https://github.com/python/cpython/commit/69b4387f78f413e8c47572a85b3478c47eba8142 (3.14)
- NOTE: https://github.com/python/cpython/commit/6279eb8c076d89d3739a6edb393e43c7929b429d (3.13)
+ NOTE: https://github.com/python/cpython/commit/69b4387f78f413e8c47572a85b3478c47eba8142 (v3.14.0b2)
+ NOTE: https://github.com/python/cpython/commit/6279eb8c076d89d3739a6edb393e43c7929b429d (v3.13.4)
CVE-2025-48051 (powertip.ts in Lila (for Lichess) before ab0beaf allows XSS in some ap ...)
NOT-FOR-US: Lichess Lila
CVE-2025-48050 (In DOMPurify through 3.2.5 before 6bc6d60, scripts/server.js does not ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e1460ccdbd29ad43bb9dc0c669a43380adf01cd3
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e1460ccdbd29ad43bb9dc0c669a43380adf01cd3
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20250606/e422c423/attachment.htm>
More information about the debian-security-tracker-commits
mailing list