Stan Ulbrych

The `socket.getaddrinfo()` function accepts null bytes within the `host` and `port` parameters, which may lead to the values being silently truncated.

An issue exists where `tarfile.tar filter` can be bypassed using specially crafted link entries, such as symlinks with empty or directory-like names. This allows a malicious archive to redirect subsequent members outside the intended extraction directory, enabling the `tarfile.extractall()` function with `filter="tar"` to write files to arbitrary locations on the system, depending on the permissions of the process performing the extraction.

The `tarfile` module's data and extraction filters are susceptible to a bypass when processing crafted archives containing a hard link that targets a symbolic link. This issue occurs during the execution of the `extractall()` function, potentially allowing an attacker to modify the permissions or modification time of files located outside the intended destination directory. Additionally, it may lead to the exposure of the contents of such files within the extracted directory tree. Non-link entries are not affected.

When extracting a link on a system that does not support links, the software falls back to extracting a member from the archive. During this process, the filter function is executed twice: once for the extracted member and once with the name set to the link location. The return value of one of these calls is ignored, whereas the member should be skipped if either call returns None.

In the `tarfile` module, the tar and data extraction filters allow the creation of empty directories outside the intended destination on POSIX platforms. This occurs when a member name leaves the destination and subsequently returns to it, such as `../evil/../dest/sub/file`. While the containment check utilizes the resolved path, intermediate directories are created based on the provided name. Member contents remain extracted within the destination. This issue does not affect Windows because `..` components are collapsed before reaching the filesystem.

The `stringprep` module incorrectly processes characters from RFC 3454 tables B.2 or B.3 by using the latest Unicode codepoint attributes instead of the required Unicode 3.2.0. This leads to mismatches when processing domain names via the `idna` codec (IDNA 2003) and the `in table b2()` function. The issue specifically impacts domain names containing characters that were either not registered or had their Unicode attributes, such as case-folding behavior, updated after Unicode 3.2.0.

A flaw exists in the `extractall()` function when using the 'data' or 'tar' filters. A specially crafted archive containing a hardlink that references a symlink stored at a deeper path can bypass these filters. The extraction process validates the symlink at its original archived location but recreates it at the shallower path of the hardlink. This allows a relative target to escape the destination directory, enabling a malicious archive to create symlinks that point outside the intended folder, which can lead to unauthorized file reads or writes outside the destination.

The `tarfile` module fails to properly handle the End of File (EOF) when a file is opened in streaming mode (mode="r|"). This can lead to a situation where an archive is parsed in an infinite loop.

`bz2.BZ2Decompressor` objects can be reused following a decompression error. If an application catches the resulting `OSError` and attempts to retry using the same decompressor, specially crafted input may cause the decompressor to resume from an invalid internal state. This leads to out-of-bounds writes to a stack buffer, which can result in a process crash when processing untrusted data.

The `tarfile.data filter` can be bypassed using crafted link entries, such as symlinks with empty or directory-like names. This allows a malicious tar archive to redirect subsequent archive members outside the intended extraction directory, causing the `tarfile.extractall()` function to write files to arbitrary locations on the system, depending on the permissions of the process performing the extraction.

The `unicodedata.normalize()` function can consume excessive CPU time when processing specially crafted Unicode input. This occurs when the input contains long sequences of combining characters with alternating Canonical Combining Class values, affecting all normalization forms.

The `xml.parsers.expat` and `xml.etree.ElementTree` modules use insufficient entropy for Expat hash-flooding protection. This allows a specially crafted XML document to trigger hash flooding, a condition where many keys are mapped to the same hash bucket, significantly slowing down processing.

A use-after-free flaw exists in the decompression modules of Python, specifically within `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile`. This issue occurs when a program re-uses a decompression object after a `MemoryError` is raised due to memory allocation failure, typically during periods of high memory pressure. A use-after-free is a condition where a program continues to use a pointer after it has been freed, which can lead to memory corruption. Exploitation of this flaw could allow an attacker to execute arbitrary code or access sensitive data. The issue is not present when using one-shot decompression helper functions such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()`, as these create a new instance for every call.

An incomplete mitigation allows for a bypass when a URL contains the string "%action". For certain browser types, this can lead to command injection into the underlying shell via the `webbrowser.open()` function.

A critical remote code execution issue exists in NexusFlow API Gateway. This issue is actively exploited by unauthenticated attackers, allowing them to gain full control of servers. The issue is identified as a zero-day with a CVSS score of 10.0. The affected component is the API Gateway. Attackers can exploit this through the API.

An incomplete fix for a previous issue related to control character validation in `http.cookies.Morsel` allows control characters to bypass input validation. The fix did not fully address the problem, leaving the `Morsel.update()`, `|= operator`, and unpickling paths vulnerable. Additionally, the `BaseCookie.js output()` function lacks the output validation present in `BaseCookie.output()`.

The Expat parser, when used with a registered ElementDeclHandler, is susceptible to a C stack overflow when processing an inline document type definition with a deeply nested content model. This occurs during the parsing of XML documents containing complex and deeply nested DTD content models.