CVE-2024-6923

A high severity vulnerability in the CPython zipfile module affecting zipfile.Path. When iterating over entry names in a zip archive (e.g., namelist(), iterdir()), unexpected behavior may occur. The more common zipfile.ZipFile class is unaffected.

The urllib.parse.urlsplit() and urlparse() functions in Python improperly validate bracketed hosts (`[]`), accepting hosts that are not IPv6 or IPvFuture. This violates RFC 3986 and could enable SSRF attacks if a URL is processed by multiple URL parsers.

A medium severity vulnerability in CPython where regular expressions allow excessive backtracking during tarfile.TarFile header parsing, leading to ReDoS via specially crafted tar archives.

In CPython's 'http.cookies' module, parsing cookies with backslash-escaped characters uses a quadratic algorithm, causing excessive CPU usage.

In CPython, the import hook handling legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and does not use io.open_code() to read the .pyc files. Consequently, sys.audit handlers for this audit event do not fire.

There is an issue in CPython when using `bytes.decode("unicode_escape", error="ignore|replace")`. If you are not using the "unicode_escape" encoding or an error handler, you are not affected. To work around, stop using the error= handler and wrap the bytes.decode() call in a try-except catching DecodeError.

In the CPython standard library module 'mimetypes', on Windows the default list of known file locations is writable, meaning other users can create invalid files to cause MemoryError on Python runtime startup or have file extensions interpreted as the incorrect file type. This defect is caused by default locations from Linux and macOS platforms (such as '/etc/mime.types') also being used on Windows, where they are user-writable locations ('C:\etc\mime.types').

CPython 3.9 and earlier does not disallow configuring an empty list ("[]") for SSLContext.set_npn_protocols(), which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used. This vulnerability is of low severity due to NPN being not widely used and specifying an empty list likely being uncommon in practice.

In CPython 3.12.0 in the subprocess module on POSIX platforms, when the extra_groups=[] parameter is used, the process does not call setgroups(0, NULL) before exec(), causing the new process to inherit the parent process's groups. This issue was fixed in CPython 3.12.1 and only affects processes run with root privileges.

In Python (CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9.