github.com/saltstack/salt

Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data". You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= param…

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying thi…

A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at the same time as certificates are loaded into the …

A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This …

Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extrac…

Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extrac…

An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference symlinks during cleanup of permissions-related errors. This means users which c…

bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to …

If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.

Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()" API could have commands injected into the underlying shell. See CVE-2026-4519 for details.

On Windows a directory returned by tempfile.mkdtemp() would not always have permissions set to restrict reading and writing to the temporary directory by other users, instead usually inheriting the correct permissions from the default location. Alternate configurations or users w…

tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself.  The extraction fallback validated the symlink at it's archived location but recreated it at the…

The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the is_private and is_global properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Addr…

The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the ou…

The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.

The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger "RecursionError: maximum recursion depth exceeded while calling a Python object" via a crafted argument. This argument is plausibly an untrusted value from an application's input data t…

There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously cra…

There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class is unaffected. When iterating over names of entries in a zip archive (for example, methods of "zipfile.Path" like "na…

There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in…

There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.

Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The …

When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.

When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.

When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior is that any filtered members would be skipped and not extracted. However the actual behavior of TarFile.errorlevel = 0 in affected versions is that the member would still be extracted and not…

'apt-get' install should use '--no-install-recommends' to minimize image size.

MAINTAINER has been deprecated since Docker 1.13.0.

Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.