目標達成 すべての支援者に感謝 — 100%達成しました！

目標: 1000 CNY · 調達済み: 1325 CNY

100%
コーヒーを一杯おごる

Python Software Foundation 厂商漏洞列表 / CVE 中文分析 60

Python Software Foundation 厂商相关 60 条 CVE 漏洞，含 AI 中文分析、POC、CVSS 评分与受影响产品。

Python Software Foundation 负责维护 Python 语言及其核心生态系统，包括 PyPI 包索引。其历史漏洞多涉及远程代码执行、路径遍历及权限提升，常源于标准库解析缺陷或第三方包供应链风险。值得关注的是，PSF 建立了安全响应机制，定期发布补丁修复高危漏洞，并推动依赖项安全最佳实践，以保障全球开发者环境稳定。

件 59 件の結果 / 60フィルターをクリア
上位製品 Python Software Foundation: CPython pymanager
CVE IDタイトルCVSS深刻度公開日
CVE-2025-13836 Excessive read buffering DoS in http.client — CPython 9.8AICriticalAI2025-12-01
CVE-2025-6075 Quadratic complexity in os.path.expandvars() with user-controlled template — CPython 7.5 -2025-10-31
CVE-2025-8291 ZIP64 End of Central Directory (EOCD) Locator record offset not checked — CPython 4.3 Medium2025-10-07
CVE-2025-8194 Tarfile infinite loop during parsing with negative member offset — CPythonCWE-835 7.5 High2025-07-28
CVE-2025-6069 HTMLParser quadratic complexity when processing malformed inputs — CPythonCWE-1333 4.3 Medium2025-06-17
CVE-2024-12718 Bypass extraction filter to modify file metadata outside extraction directory — CPythonCWE-22 5.3 Medium2025-06-03
CVE-2025-4435 Tarfile extracts filtered members when errorlevel=0 — CPython 7.5 High2025-06-03
CVE-2025-4138 Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory — CPythonCWE-22 7.5 High2025-06-03
CVE-2025-4330 Extraction filter bypass for linking outside extraction directory — CPythonCWE-22 7.5 High2025-06-03
CVE-2025-4517 Arbitrary writes via tarfile realpath overflow — CPythonCWE-22 9.4 Critical2025-06-03
CVE-2025-4516 Use-after-free in "unicode_escape" decoder with error handler — CPythonCWE-416 7.5AIHighAI2025-05-15
CVE-2025-1795 Mishandling of comma during folding and unicode-encoding of email headers — CPython 7.5 -2025-02-28
CVE-2024-3220 Default mimetype known files writeable on Windows — CPythonCWE-426 5.5 -2025-02-14
CVE-2025-0938 URL parser allowed square brackets in domain names — CPythonCWE-20 9.1 -2025-01-31
CVE-2024-12254 Unbounded memory buffering in SelectorSocketTransport.writelines() — CPythonCWE-400 7.5 -2024-12-06
CVE-2024-11168 Improper validation of IPv6 and IPvFuture addresses — CPython 9.1 -2024-11-12
CVE-2024-9287 Virtual environment (venv) activation scripts don't quote paths — CPythonCWE-428 10.0AICriticalAI2024-10-22
CVE-2024-6232 Regular-expression DoS when parsing TarFile headers — CPythonCWE-1333 6.5 -2024-09-03
CVE-2024-8088 Infinite loop when iterating over zip archive entry names from zipfile.Path — CPythonCWE-835 6.5 -2024-08-22
CVE-2024-7592 Quadratic complexity parsing cookies with backslashes — CPythonCWE-400 5.3 -2024-08-19
CVE-2024-6923 Email header injection due to unquoted newlines — CPython 4.3 -2024-08-01
CVE-2024-3219 Pure-Python fallback of socket.socketpair() doesn’t authenticate peer connection — CPython 6.3AIMediumAI2024-07-29
CVE-2024-5642 Buffer overread when using an empty list with SSLContext.set_npn_protocols() — CPython--AI2024-06-27
CVE-2024-0397 Memory race condition in ssl.SSLContext certificate store methods — CPython 7.4AIHighAI2024-06-17
CVE-2024-4032 Incorrect IPv4 and IPv6 private ranges — CPython 7.5AIHighAI2024-06-17
CVE-2024-4030 tempfile.mkdtemp() may be readable and writeable by all users on Windows — CPythonCWE-276 7.1AIHighAI2024-05-07
CVE-2023-6597 Python 安全漏洞 — CPython 7.8 High2024-03-19
CVE-2024-0450 Quoted zip-bomb protection for zipfile — CPythonCWE-405 6.2 Medium2024-03-19
CVE-2023-6507 Groups not dropped before running subprocess when using empty 'extra_groups' parameter — CPythonCWE-269 6.1 Medium2023-12-08

本页汇总了 Python Software Foundation 厂商截至目前公开的全部 60 条 CVE 漏洞。每条漏洞均包含 CVSS 评分、CWE 弱点分类、受影响产品与参考链接，并附带 AI 生成的中文分析以便快速判断风险。