saltbundlepy-urllib3 vulnerabilities (SUSE)
44 vulnerabilities.
saltbundlepy-urllib3SUSEpip absolute path traversal during download from malicious package indexes5.6 Mediumsaltbundlepy-urllib3SUSEIncremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations8.7 Highsaltbundlepy-urllib3SUSETarfile.extract() doesn't fully respect filter parameter2.0 Lowsaltbundlepy-urllib3SUSElxml: javascript: URL bypass in Cleaner via xlink:href8.2 Highsaltbundlepy-urllib3SUSEtarfile opened in streaming mode mishandles EOF8.2 Highsaltbundlepy-urllib3SUSEConfiguration Injection via Carriage Return (\r) in write() method4.1 Mediumsaltbundlepy-urllib3SUSEtarfile extraction filter bypass allows escaping the destination directory7.8 Highsaltbundlepy-urllib3SUSEtornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)7.5 Highsaltbundlepy-urllib3SUSETornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient7.7 Highsaltbundlepy-urllib3SUSETornado: Out-of-bounds memory access in C extension5.3 Mediumsaltbundlepy-urllib3SUSEtarfile.data_filter path traversal bypass allows writing outside the extraction directory6.9 Mediumsaltbundlepy-urllib3SUSEPotential DoS via quadratic complexity in unicodedata.normalize()6.3 Mediumsaltbundlepy-urllib3SUSEpip can extract console_scripts and gui_scripts outside installation directory4.1 Mediumsaltbundlepy-urllib3SUSEInternationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix6.9 Mediumsaltbundlepy-urllib3SUSEFTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address5.9 Mediumsaltbundlepy-urllib3SUSEThe expat and elementtree parsers use insufficient entropy for XML hash-flooding protection6.3 Mediumsaltbundlepy-urllib3SUSEurllib3: Sensitive headers forwarded across origins in proxied low-level redirects8.2 Highsaltbundlepy-urllib3SUSESecurity update for python-pyOpenSSLNo scoresaltbundlepy-urllib3SUSEpip self-update functionality can import newly installed modules after wheel installation5.3 Mediumsaltbundlepy-urllib3SUSEBaseCookie.js_output() does not neutralize embedded characters2.1 Lowsaltbundlepy-urllib3SUSElxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files7.5 Highsaltbundlepy-urllib3SUSEpip doesn't reject concatenated ZIP and tar archives4.6 Mediumsaltbundlepy-urllib3SUSEIncomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()7.0 Highsaltbundlepy-urllib3SUSEUse-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure9.1 Criticalsaltbundlepy-urllib3SUSEBase64 decoding stops at first padded quad by default6.0 Mediumsaltbundlepy-urllib3SUSEHTTP client proxy tunnel headers not validated for CR/LF5.7 Mediumsaltbundlepy-urllib3SUSEpkgutil.get_data() does not enforce documented restrictions0.0 Nonesaltbundlepy-urllib3SUSEpyOpenSSL DTLS cookie callback buffer overflow7.2 Highsaltbundlepy-urllib3SUSELimited path traversal when installing wheel archives2.0 Lowsaltbundlepy-urllib3SUSEExcessive read buffering DoS in http.client6.3 Mediumsaltbundlepy-urllib3SUSEHTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net4.4 Mediumsaltbundlepy-urllib3SUSEInfinite loop when iterating over zip archive entry names from zipfile.Path8.7 Highsaltbundlepy-urllib3SUSEQuadratic complexity parsing cookies with backslashes7.5 Highsaltbundlepy-urllib3SUSEEmail header injection due to unquoted newlines5.5 Mediumsaltbundlepy-urllib3SUSERemote Code Execution in pypa/setuptools8.8 Highsaltbundlepy-urllib3SUSEDenial of Service via crafted zip file in jaraco/zipp6.2 Mediumsaltbundlepy-urllib3SUSEProxy-Authorization request header isn't stripped during cross-origin redirects in urllib34.4 Mediumsaltbundlepy-urllib3SUSEMemory race condition in ssl.SSLContext certificate store methods7.4 Highsaltbundlepy-urllib3SUSEIncorrect IPv4 and IPv6 private ranges7.5 Highsaltbundlepy-urllib3SUSEDenial of Service via Quadratic Complexity in kjd/idna6.2 Mediumsaltbundlepy-urllib3SUSEHTTP/2 CONTINUATION flood in net/http7.5 Highsaltbundlepy-urllib3SUSEJinja vulnerable to Cross-Site Scripting (XSS)5.4 Mediumsaltbundlepy-urllib3SUSEUncontrolled Resource Consumption in promhttp7.5 Highsaltbundlepy-urllib3SUSEInvoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna9.6 Critical