Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
dcd4d32a by Salvatore Bonaccorso at 2025-07-17T22:02:04+02:00
Update status in sync with MR!219 for pypy3
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -13805,6 +13805,7 @@ CVE-2025-4517 (Allows arbitrary filesystem writes
outside the extraction directo
[bookworm] - python3.11 <not-affected> (Vulnerable code didn't get
backported to the version in Bookworm)
- python3.9 <not-affected> (Vulnerable code got backported to 3.9.17,
but dropped from sid with 3.9.13)
- python2.7 <not-affected> (Vulnerable code introduced in 3.12)
+ [experimental] - pypy3 7.3.20+dfsg-1
- pypy3 <unfixed>
[bullseye] - pypy3 <not-affected> (Vulnerable code backported down to
stdlib-3.9.17; embedding 3.6.9)
- jython <not-affected> (Vulnerable code introduced in 3.12)
@@ -13818,7 +13819,6 @@ CVE-2025-4517 (Allows arbitrary filesystem writes
outside the extraction directo
NOTE: Fixed by:
https://github.com/python/cpython/commit/19de092debb3d7e832e5672cc2f7b788d35951da
(v3.12.11)
NOTE: Got backported to 3.9 in
https://github.com/python/cpython/commit/98016f7c92aa4c1232c68bac1ed6646db31782ec
(v3.9.17)
NOTE: Got backported to 3.11 in
https://github.com/python/cpython/commit/241f2e54a6a2801a1d2022f0fa56309e124866c3
(v3.11.4)
- NOTE: In experimental, pypy3 fixed in 7.3.20+dfsg-1
CVE-2025-4435 (When using a TarFile.errorlevel = 0and extracting with a filter
the do ...)
- python3.13 3.13.4-1
- python3.12 <unfixed>
@@ -13826,6 +13826,7 @@ CVE-2025-4435 (When using a TarFile.errorlevel = 0and
extracting with a filter t
[bookworm] - python3.11 <not-affected> (Vulnerable code didn't get
backported to the version in Bookworm)
- python3.9 <not-affected> (Vulnerable code got backported to 3.9.17,
but dropped from sid with 3.9.13)
- python2.7 <not-affected> (Vulnerable code introduced in 3.12)
+ [experimental] - pypy3 7.3.20+dfsg-1
- pypy3 <unfixed>
[bullseye] - pypy3 <not-affected> (Vulnerable code backported down to
stdlib-3.9.17; embedding 3.6.9)
- jython <not-affected> (Vulnerable code introduced in 3.12)
@@ -13838,7 +13839,6 @@ CVE-2025-4435 (When using a TarFile.errorlevel = 0and
extracting with a filter t
NOTE: Fixed by:
https://github.com/python/cpython/commit/19de092debb3d7e832e5672cc2f7b788d35951da
(v3.12.11)
NOTE: Got backported to 3.9 in
https://github.com/python/cpython/commit/98016f7c92aa4c1232c68bac1ed6646db31782ec
(v3.9.17)
NOTE: Got backported to 3.11 in
https://github.com/python/cpython/commit/241f2e54a6a2801a1d2022f0fa56309e124866c3
(v3.11.4)
- NOTE: In experimental, pypy3 fixed in 7.3.20+dfsg-1
CVE-2025-4420 (The Vayu Blocks \u2013 Gutenberg Blocks for WordPress &
WooCommerce pl ...)
NOT-FOR-US: WordPress plugin
CVE-2025-4392 (The Shared Files \u2013 Frontend File Upload Form & Secure File
Sharin ...)
@@ -13872,6 +13872,7 @@ CVE-2025-4138 (Allows the extraction filter to be
ignored, allowing symlink targ
[bookworm] - python3.11 <not-affected> (Vulnerable code didn't get
backported to the version in Bookworm)
- python3.9 <not-affected> (Vulnerable code got backported to 3.9.17,
but dropped from sid with 3.9.13)
- python2.7 <not-affected> (Vulnerable code introduced in 3.12)
+ [experimental] - pypy3 7.3.20+dfsg-1
- pypy3 <unfixed>
[bullseye] - pypy3 <not-affected> (Vulnerable code backported down to
stdlib-3.9.17; embedding 3.6.9)
- jython <not-affected> (Vulnerable code introduced in 3.12)
@@ -13884,7 +13885,6 @@ CVE-2025-4138 (Allows the extraction filter to be
ignored, allowing symlink targ
NOTE: Fixed by:
https://github.com/python/cpython/commit/19de092debb3d7e832e5672cc2f7b788d35951da
(v3.12.11)
NOTE: Got backported to 3.9 in
https://github.com/python/cpython/commit/98016f7c92aa4c1232c68bac1ed6646db31782ec
(v3.9.17)
NOTE: Got backported to 3.11 in
https://github.com/python/cpython/commit/241f2e54a6a2801a1d2022f0fa56309e124866c3
(v3.11.4)
- NOTE: In experimental, pypy3 fixed in 7.3.20+dfsg-1
CVE-2025-48998 (DataEase is an open source business intelligence and data
visualizatio ...)
NOT-FOR-US: DataEase
CVE-2025-48997 (Multer is a node.js middleware for handling
`multipart/form-data`. A v ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/dcd4d32a8ad265c36fc10f8eae721af260623748
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/dcd4d32a8ad265c36fc10f8eae721af260623748
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
