[<prev] [day] [month] [year] [list]
Message-ID: <2f3a87b4-ebe4-48e0-971c-6a445664c67b@oracle.com>
Date: Fri, 5 Dec 2025 14:32:55 -0800
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com
Subject: CPython vulnerable to CVE-2025-13836, CVE-2025-13837,
& CVE-2025-12084
-------- Forwarded Message --------
Subject: [Security-announce][CVE-2025-13836] Excessive read buffering DoS in http.client
Date: Mon, 1 Dec 2025 18:57:32 +0000
From: Seth Larson <seth@...hon.org>
Reply-To: security-sig@...hon.org
To: security-announce@...hon.org
There is a MEDIUM severity vulnerability affecting CPython.
When reading an HTTP response from a server, if no read amount is specified, the
default behavior will be to use Content-Length. This allows a malicious server
to cause the client to read large amounts of data into memory, potentially
causing OOM or other DoS.
Please see the linked CVE ID for the latest information on
affected versions:
* https://www.cve.org/CVERecord?id=CVE-2025-13836
* https://github.com/python/cpython/pull/119454
-------- Forwarded Message --------
Subject: [Security-announce][CVE-2025-13837] Out-of-memory when loading Plist
Date: Mon, 1 Dec 2025 18:58:33 +0000
From: Seth Larson <seth@...hon.org>
Reply-To: security-sig@...hon.org
To: security-announce@...hon.org
There is a LOW severity vulnerability affecting CPython.
When loading a plist file, the plistlib module reads data in size specified by
the file itself, meaning a malicious file can cause OOM and DoS issues
Please see the linked CVE ID for the latest information on affected versions:
* https://www.cve.org/CVERecord?id=CVE-2025-13837
* https://github.com/python/cpython/pull/119343
-------- Forwarded Message --------
Subject: [Security-announce][CVE-2025-12084] Quadratic complexity in node ID cache clearing
Date: Wed, 3 Dec 2025 18:59:03 +0000
From: Seth Larson <seth@...hon.org>
Reply-To: security-sig@...hon.org
To: security-announce@...hon.org
There is a MEDIUM severity vulnerability affecting CPython.
When building nested elements using xml.dom.minidom methods such as
appendChild() that have a dependency on _clear_id_cache() the algorithm is
quadratic. Availability can be impacted when building excessively nested
documents.
Please see the linked CVE ID for the latest information on affected versions:
* https://www.cve.org/CVERecord?id=CVE-2025-12084
* https://github.com/python/cpython/pull/142146
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
