Exposure of Python

Programming languages

exposure score

130,864

sites use

exploited

critical

Vexday analysis

O histórico de vulnerabilidades catalogadas para Python é relativamente reduzido, com 12 CVEs registradas e nenhuma ocorrência nos últimos 90 dias, o que indica baixa atividade recente de descoberta. A taxa de exploração ativa está abaixo da média geral do catálogo CISA KEV, com zero entradas confirmadas em uso por agentes de ameaça. Ainda assim, a CVE mais perigosa identificada, CVE-2019-5010, apresenta um score EPSS de aproximadamente 0,21, sugerindo probabilidade não desprezível de exploração e merecendo atenção em ambientes que ainda não aplicaram a correção correspondente. O tipo de falha mais recorrente é CWE-20 (validação inadequada de entrada), padrão que tende a se manifestar em bibliotecas e interpretadores amplamente reutilizados, reforçando a importância de revisão de código e atualização de dependências em projetos que fazem uso da plataforma.

CVEs

12 results

CVE-2019-5010MEDIUMAn exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafteEPSS 21.4%CVE-2021-3737HIGHA flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls EPSS 11.6%CVE-2018-14647MEDIUMPython's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial oEPSS 11.3%CVE-2022-0391HIGHA flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings intoEPSS 8.3%CVE-2020-10735—A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could takeEPSS 5.9%CVE-2019-10160CRITICALA security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7EPSS 5.4%CVE-2018-1060MEDIUMpython before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. AnEPSS 5.3%CVE-2018-1061MEDIUMpython before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK meEPSS 5.0%CVE-2021-3733—There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as webEPSS 4.7%CVE-2021-4189MEDIUMA flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTPEPSS 2.7%CVE-2021-3426MEDIUMThere's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to starEPSS 1.9%CVE-2017-20052MEDIUMPython pgAdmin4 uncontrolled search pathEPSS 1.2%