Kirill Podoprigora

When tarfile or zipfile command line interface (CLI) is used to decompress an archive, a Python script shadowing the stdlib can be created. Then if an error occurs during decompressing the next file, the newly created Python script is executed. This is especially true if the created Python is called traceback.py. The problem is that Python adds the current directory to sys.path when python -m MODULE is run, and the archive is also decompressed in the current directory. The fix removes sys.path[0] in gzip, tarfile and zipfile command line interface to prevent shadowing standard library modules from extracted files.

http.cookiejar.CookieJar deleted a stored cookie when a response carried an already expired Set-Cookie header for it, using the Domain and Path attributes from the header without consulting the cookie policy. A server could therefore delete cookies belonging to other domains from a shared cookie jar, such as the one used by urllib's HTTPCookieProcessor. The fix consults the cookie policy before an expired cookie may delete an existing one, as required by RFC 6265 section 5.3.

When ca certs parameter was supplied to ssl.get server certificate() function, the identity of the certificate is not checked.

The `HTTPPasswordMgr` class in the `urllib.request` module, including its subclasses `HTTPPasswordMgrWithDefaultRealm` and `HTTPPasswordMgrWithPriorAuth`, fails to consider the URL scheme when matching stored credentials to a requested URL. This allows credentials intended for `https://` to be sent over `http://` if an attacker can redirect or downgrade the client connection, potentially leading to the capture of credentials in cleartext. Conversely, credentials for `http://` could be sent over `https://`. Credential matching is now restricted by URL scheme, meaning credentials registered with a specific scheme are only used for requests using that same scheme, while those registered with a bare authority remain compatible with any scheme.