git: 5e6a4ea2aa12 - main - security/vuxml: Add python3 vulnerability

Go to: [ bottom of page ] [ top of archives ] [ this month ]
From: Fernando Apesteguía <fernape_at_FreeBSD.org>
Date: Sat, 24 May 2025 16:34:11 UTC
The branch main has been updated by fernape:

URL: https://cgit.FreeBSD.org/ports/commit/?id=5e6a4ea2aa12abbf7eab30a7d7b37cfda49000d3

commit 5e6a4ea2aa12abbf7eab30a7d7b37cfda49000d3
Author:     Fernando Apesteguía <fernape@FreeBSD.org>
AuthorDate: 2025-05-24 15:20:34 +0000
Commit:     Fernando Apesteguía <fernape@FreeBSD.org>
CommitDate: 2025-05-24 15:33:50 +0000

    security/vuxml: Add python3 vulnerability
    
     * CVE-2025-4516
    
    PR:             287009
    Reported by:    ngie@
---
 security/vuxml/vuln/2025.xml | 44 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 44 insertions(+)

diff --git a/security/vuxml/vuln/2025.xml b/security/vuxml/vuln/2025.xml
index a58ddfcd10db..0c4d3ccee4af 100644
--- a/security/vuxml/vuln/2025.xml
+++ b/security/vuxml/vuln/2025.xml
@@ -1,3 +1,47 @@
+  <vuln vid="e587b52d-38ac-11f0-b7b6-dcfe074bd614">
+    <topic>cpython -- Use-after-free in &quot;unicode_escape&quot; decoder with error handler</topic>
+    <affects>
+      <package>
+	<name>python39</name>
+	<range><lt>3.9.22</lt></range>
+      </package>
+      <package>
+	<name>python310</name>
+	<range><lt>3.10.17</lt></range>
+      </package>
+      <package>
+	<name>python311</name>
+	<range><lt>3.11.12</lt></range>
+      </package>
+      <package>
+	<name>python312</name>
+	<range><lt>3.12.10</lt></range>
+      </package>
+    </affects>
+    <description>
+	<body xmlns="http://www.w3.org/1999/xhtml">
+	<p>cna@python.org reports:</p>
+	<blockquote cite="https://github.com/python/cpython/commit/69b4387f78f413e8c47572a85b3478c47eba8142">
+	  <p>There is an issue in CPython when using
+	`bytes.decode(&quot;unicode_escape&quot;,
+	error=&quot;ignore|replace&quot;)`.  If you are not using the
+	&quot;unicode_escape&quot; encoding or an error handler your
+	usage is not affected.  To work-around this issue you may stop
+	using the error= handler and instead wrap the bytes.decode()
+	call in a try-except catching the DecodeError.</p>
+	</blockquote>
+	</body>
+    </description>
+    <references>
+      <cvename>CVE-2025-4516</cvename>
+      <url>https://nvd.nist.gov/vuln/detail/CVE-2025-4516</url>
+    </references>
+    <dates>
+      <discovery>2025-05-15</discovery>
+      <entry>2025-05-24</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="5baa64d6-37ee-11f0-a116-8447094a420f">
     <topic>OpenSSL -- Inverted security logic in x509 app</topic>
     <affects>