Kirill Podoprigora

When tarfile or zipfile command line interface (CLI) is used to decompress an archive, a Python script shadowing the stdlib can be created. Then if an error occurs during decompressing the next file, the newly created Python script is executed. This is especially true if the created Python is called traceback.py. The problem is that Python adds the current directory to sys.path when python -m MODULE is run, and the archive is also decompressed in the current directory. The fix removes sys.path[0] in gzip, tarfile and zipfile command line interface to prevent shadowing standard library modules from extracted files.

http.cookiejar.CookieJar deleted a stored cookie when a response carried an already expired Set-Cookie header for it, using the Domain and Path attributes from the header without consulting the cookie policy. A server could therefore delete cookies belonging to other domains from a shared cookie jar, such as the one used by urllib's HTTPCookieProcessor. The fix consults the cookie policy before an expired cookie may delete an existing one, as required by RFC 6265 section 5.3.

When ca certs parameter was supplied to ssl.get server certificate() function, the identity of the certificate is not checked.

A classe `HTTPPasswordMgr` no módulo `urllib.request`, incluindo suas subclasses `HTTPPasswordMgrWithDefaultRealm` e `HTTPPasswordMgrWithPriorAuth`, não considera o esquema da URL ao associar credenciais armazenadas a uma URL solicitada. Isso permite que credenciais destinadas ao `https://` sejam enviadas via `http://` caso um invasor consiga redirecionar ou rebaixar a conexão do cliente, podendo resultar na captura de credenciais em texto claro. Inversamente, credenciais para `http://` poderiam ser enviadas via `https://`. A correspondência de credenciais agora é limitada pelo esquema da URL, significando que credenciais registradas com um esquema específico são usadas apenas para solicitações com o mesmo esquema, enquanto aquelas registradas com uma autoridade simples permanecem compatíveis com qualquer esquema.