Victor Stinner

When tarfile or zipfile command line interface (CLI) is used to decompress an archive, a Python script shadowing the stdlib can be created. Then if an error occurs during decompressing the next file, the newly created Python script is executed. This is especially true if the created Python is called traceback.py. The problem is that Python adds the current directory to sys.path when python -m MODULE is run, and the archive is also decompressed in the current directory. The fix removes sys.path[0] in gzip, tarfile and zipfile command line interface to prevent shadowing standard library modules from extracted files.

http.cookiejar.CookieJar deleted a stored cookie when a response carried an already expired Set-Cookie header for it, using the Domain and Path attributes from the header without consulting the cookie policy. A server could therefore delete cookies belonging to other domains from a shared cookie jar, such as the one used by urllib's HTTPCookieProcessor. The fix consults the cookie policy before an expired cookie may delete an existing one, as required by RFC 6265 section 5.3.

Em sistemas Windows, a função `sock recvfrom into()` dentro de `asyncio.ProacterEventLoop` não possui uma verificação de limite para o buffer de dados ao utilizar o parâmetro `nbytes`. Essa falha pode permitir uma gravação de buffer fora dos limites se os dados de rede recebidos forem maiores que o tamanho do buffer, resultando potencialmente em corrupção de memória, travamentos do sistema ou execução de código arbitrário. Plataformas que não sejam Windows não são afetadas.

An incomplete fix for a previous issue related to control character validation in `http.cookies.Morsel` allows control characters to bypass input validation. The fix did not fully address the problem, leaving the `Morsel.update()`, `|= operator`, and unpickling paths vulnerable. Additionally, the `BaseCookie.js output()` function lacks the output validation present in `BaseCookie.output()`.

Um problema no kernel Linux na arquitetura AArch64 ignora o byte superior no endereço passado para a chamada de sistema `brk`, potencialmente deslocando o limite da memória para baixo quando o aplicativo espera que ele se desloque para cima. Observou-se que isso causa corrupção da pilha com a implementação `malloc` da Biblioteca C do GNU. O problema está relacionado a um estouro de buffer na memória, que pode ser explorado para causar uma negação de serviço.

The issue is related to insufficient neutralization of special elements in a request, which may allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The problem lies in the Lib/webbrowser.py component of the Python interpreter, where strings are not properly validated before launching a program specified by the BROWSER environment variable. This could potentially allow remote attackers to conduct argument-injection attacks via a crafted URL. However, a software maintainer indicates that exploitation is impossible due to the code relying on subprocess.Popen and the default shell=False setting.