CVE and update status of the FreeBSD ports tree4,526 unaddressed CVEs in 616 portsAll times are CET

Port details

lang/python272.7.18_5

Interpreted object-oriented programming language

Maintainer
python@FreeBSD.org
Packages
python27 2.7.18_5
Upstream
Higher version available: 3.15.1
CPE
python:python from the port
WWW
https://www.python.org/
Links
cgit · VuXML

Unaddressed (33) · The CVE record lists this version as affected, no VuXML entry names the CVE

Updating to 3.13.14 would fix 27 of 33 unaddressed CVEs, according to the CVE records.
Fixed up to each version, cumulative: 3.9.21 15 · 3.10.0 16 · 3.10.20 17 · 3.10.21 19 · 3.13.10 21 · 3.13.11 22 · 3.13.13 25 · 3.13.14 27
CVE-2022-485659.82023-08-22An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vuln…
CVE-2007-45599.82007-08-28Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbi…
CVE-2017-175228.82017-12-14Lib/webbrowser.py in Python through 3.6.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote …
CVE-2026-153088.72026-07-09The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.
CVE-2024-62327.52024-09-03There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulner…
CVE-2024-75927.52024-08-19There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for q…
CVE-2022-485607.52023-08-22A use-after-free exists in Python through 3.9 via heappushpop in heapq.
CVE-2023-366327.52023-06-25The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger "RecursionError: maximum recursion depth exceeded while calling a Python o…
CVE-2023-243297.52023-02-17An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.
CVE-2022-450617.52022-11-09An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such t…
CVE-2022-03917.52022-02-09A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involv…
CVE-2026-45197.02026-03-20The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading …
CVE-2022-485646.52023-08-22read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property List files i…
CVE-2021-37336.52022-03-10There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could …
CVE-2017-182076.52018-03-01The Wave_read._read_fmt_chunk function in Lib/wave.py in Python through 3.6.4 does not ensure a nonzero channel value, which allows attackers to cause a denial of servic…
CVE-2026-72106.32026-05-11`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding…
CVE-2025-127816.32026-01-21When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be accepted, regardl…
CVE-2025-120846.32025-12-03When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability ca…
CVE-2025-138366.32025-12-01When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause …
CVE-2026-30876.02026-04-27If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target di…
CVE-2026-42246.02026-03-16When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.
CVE-2026-36446.02026-03-16The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patc…
CVE-2022-485665.92023-08-22An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possible in the accumulator variable in hmac…
CVE-2021-233365.92021-02-15The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache P…
CVE-2024-92875.32024-10-22A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the …
Show all 33
CVE-2023-402175.32023-08-25An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers…
CVE-2023-270435.32023-04-19The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as t…
CVE-2026-08644.12026-06-23When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be inje…
CVE-2026-60192.12026-04-22http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive seq…
CVE-2025-138372.12025-12-01When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues
CVE-2026-43602.02026-06-30In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar fil…
CVE-2025-134622.02026-03-12The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE…
CVE-2025-60751.82025-10-31If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.

VuXML only (0) · listed, port not fixed yet

None. pkg audit reports nothing for this version.

Fixed (10)

Show 10 fixed
VuXML entries whose affected range this version has left.

Commits (342)

Kubilay Kocak (koobs) · 2.7.6
All Python ports: Address abort() for ctypes import on FreeBSD/ARM

The current FreeBSD/ARM __clear_cache() implementation does nothing #if
__i386__ || __x86_64__ #else abort();

cognet@ advises this is an issue for anything !Apple that is using the
libcompiler_rt provided by Clang on ARM, and requires upstreaming.

This is the root cause of abort() on import for the ctypes module in
Python, as they bundle libffi. [1]

This change patches the bundled libffi library in all Python ports, even
though it is a NOOP for the ports that use devel/libffi. These ports,
currently python31, will get the fix via ports/184517

A huge shout out to cognet@ who helped diagnose the issue and created
the patch to address it. Thank you!

PR:		ports/149167 [1]
PR:		ports/184517
Submitted by:	cognet [3]
Reviewed by:	cognet, eadler, milki, ak
d536d1d88b
Kubilay Kocak (koobs) · 2.7.6
lang/python27: Remove patch-configure, its now a NOOP

lang/python26, lang/python27 and lang/python31 now add
ac_cv_opt_olimit_ok=no to CONFIGURE_ENV to disable functionality that
was removed in Python 3.2+ [1]

Pending a backport of the commit [2] to 2.7, we can now remove the
locally maintained patch to configure that disabled the functionality
when CC = clang.

Apart from being narrower in scope than ac_cv_opt_olimit_ok=no, the patch
doesn't work for FreeBSD versions where clang *is* cc (eg: 10.0+)

[1] http://hg.python.org/lookup/r85656
[2] http://bugs.python.org/issue877121

Reviewed by:	antoine
a8610b8d32
Kubilay Kocak (koobs) · 2.7.6
lang/python27: Update to 2.7.6

- Update to 2.7.6
- Update pkg-plist
- Temporarily override OPT:Olimit using CONFIGURE_ENV (ports/182952) [1]
- Replace patch: extra-patch-configure-pth with CONFIGURE_ENV instead
- Remove patch: patch-Modules-_ctypes-libffi_fficonfig.py.in [2]
- QA: Clean up and group related USE_*, WRKSRC and CONFIGURE entries
- QA: Whitespace alignment

Changes: 2.7.6 - November 10, 2013

http://www.python.org/download/releases/2.7.6/

[1] Python removed OPT:Olimit in 3.2+, requested backport or
    alternative upstream patch: http://bugs.python.org/issue877121
[2] Upstreamed: http://bugs.python.org/issue18178

PR:		ports/182952
PR:		ports/156759
Reviewed by:	antoine, mva
9c597eecc6
William Grzybowski (wg) · 2.7.5_4
lang/python27: fix patch for SEM option

PR:		ports/183884
f451bf37d7
William Grzybowski (wg) · 2.7.5_4
lang/python27: add support for freebsd11

PR:		ports/183597
Submitted by:	avilla
f760a28ec7
Baptiste Daroussin (bapt) · 2.7.5_3
Add NO_STAGE all over the place in preparation for the staging support (cat: lang)
888ab73a81
Kubilay Kocak (koobs) · 2.7.5_3
Resolve gettext (libintl) detection and linking in all Python ports

Fix gettext (NLS) detection, includes and linking:
- all: Use LDFLAGS and CPPFLAGS over CFLAGS for NLS option (with comment)
- python26,27: Pass LIBS="-lintl" to CONFIGURE_ENV

Workaround Pythons odd build mechanics causing duplicate args:
- all: Remove CFLAGS from OPT= in CONFIGURE_ENV
- python32,33: Remove CONFIGURE_* variables from Makefile.pre.in

Other:
- python32: Patch setup.py to pass OPT correctly to shared modules

PR:		ports/181721
Reported by:	pawel
Reviewed by:	bapt mva sbz
ec7259ec32
Marcus von Appen (mva) · 2.7.5_2
- Move the symlink magic for the default python version into lang/python   and lang/python2 and lang/python3. This change brings us closer to the goal   of making Python ports usable with different Python versions at the same   time. - Add a new lang/python2 port to handle the symlinks for bin/python2,   bin/idle2, bin/pydoc2 and so on. - Add a new lang/python3 port to handle the symlinks for bin/
7452555915
Alex Kozlov (ak) · 2.7.5_1
- Remove MAKE_JOBS_SAFE variable

Approved by:	portmgr (bdrewery)
d4041784dc
Li-Wen Hsu (lwhsu) · 2.7.5_1
Correct syntax in kernel config is 'options'

Submitted by:	kevlo
5ad157df04
Ruslan Makhmatkhanov (rm) · 2.7.5_1
Add patch that resolves the issue, found after r250991 in src HEAD. Investigation and the patch are from Marcel Moolenaar.

I also added upstream bug-report, based on Marcel's info:
http://bugs.python.org/issue18178

There also was relevant discussion on current@:
http://lists.freebsd.org/pipermail/freebsd-current/2013-June/

Please see there for details of the issue.

Submitted by:	marcel (python@ ML)
Reported by:	many
b922bed77e
Ruslan Makhmatkhanov (rm) · 2.7.5
- update to latest upstream versions:   . lang/python27: 2.7.3 -> 2.7.5   . lang/python32: 3.2.3 -> 3.2.4   . lang/python33: 3.3.0 -> 3.3.1 - update Mk/bsd.python.mk with new versions - mark lang/python26 and lang/python31 as deprecated (set them to   upstream EoL dates) - update docs (lang/python-doc-html) - align databases/py-bsddb patch for python27 - most of it was applied   upstream. Raise BD

Many thanks to Martin (miwi) for his time on this update.

PR:		178506
Submitted by:	rm (myself)
Exp-run by:	    portmgr (miwi)

- revert erroneous threads patch in lang/python26 and lang/python27,
  that was added after ports/131080. It was rejected upstream, because it's
  not actually a bug, but misuse.

  Gabor Pali (pgj) in collaboration with Kubilay Kocak (koobs) did an
  independent investigation regard the issue. See here for details:

  http://lists.freebsd.org/pipermail/freebsd-python/2013-April/005376.html

PR:	    153167
Submitted by:	Duncan Findlay <duncan@duncf.ca>
Reported by:	pgj/koobs (at python@ ML)
Exp-run by:     portmgr (miwi)
11bf569497
Ruslan Makhmatkhanov (rm) · 2.7.3_6
Commit all the non-functional changes to python ports to reduce the diff size for an exp-run of updated python versions.

- trim Makefile headers
- remove leading indefinite article from COMMENT
- use PYTHON shortcut in MASTER_SITES
- whitespace fixes
- remove checks for unsupported versions of FreeBSD
- use static value ``33'' instead of PYTHON_SUFFIX in lang/python33/pkg-plist,
  because this value is not supposed to be changed across the branch and for
  consistency with other python3 ports
- remove conflicts in lang/python-mode.el with not more existing python-2.4
f831a5f25d
Jason Helfman (jgh) · 2.7.3_6
- adoption of USES for gettext

Approved by:	portmgr (bapt@)
7cdc62b981
Jung-uk Kim (jkim) · 2.7.3_6
- Update devel/libffi to 3.0.11. - Reset maintainership for libffi.  See ports/164941.

PR:		ports/171768
Submitted by:	Takefu <takefu@airport.fm>
57945c1ebe
Marcus von Appen (mva) · 2.7.3_6
- Fix the -OPT:Olimit=X detection for clang, which could pollute the   output of python27-config --cflags

PR:		ports/172859 ports/161494 ports/174525
Submitted by:	Oleg Nauman <oleg.nauman@gmail.com>
996e4b60c3
Li-Wen Hsu (lwhsu) · 2.7.3_5
- Remove "first-installed-win" logic for automatically setting   ${PYTHON_DEFAULT_VERSION}, this generates conflicting packages.

- Create symbolic links as PEP 394 [1] suggests. ${PYTHON_DEFAULT_VERSION}
  will create python and python${MAJOR_VERSION} links.  In current default,
  lang/python27 will create: python -> python2 -> python2.7

- Introduce ${PYTHON3_DEFAULT_VERSION}, which will handle bin/python3 link.
  At this point, lang/python33 will create python3 -> python3.3

- Minor cleanups
  * Trim Makefile headers
  * Remove ${OSVERSION} detection for xz, whihc is done by USE_XZ

[1] http://www.python.org/dev/peps/pep-0394/
6e2fa0573b
Dmitry Sivachenko (demon) · 2.7.3_4
Create python2 symlink for the latest version of python2.X executable and python3 symlink for the latest version of python3.X executable.

People who really want to use older python version for both python branches
should specify explicit version number in interpreter invocation.

Discussed on python@ long ago.
10277be714
Koop Mast (kwm) · 2.7.3_3
Don't try to tidy up user-created directories.

Approved by:	crees (python@)
4e9d93dbac
Ruslan Makhmatkhanov (rm) · 2.7.3_3
- do not hardcode distfile extension for lang/python ports in bsd.python.mk   (PYTHON_DISTFILE variable) - switch lang/python ports (and it's slaves) to tar.xz

I compared all the four pairs .tgz/.tar.xz and they have no content differences.

Discussed on:	python@
309da33d2f
Olli Hauer (ohauer) · 2.7.3_3
- fix PORT_OPTIONS s/)/}/
f1ddff4b92
Marcus von Appen (mva) · 2.7.3_3
- Fix Python OPT flags for WITH_PTH knob

PR:		ports/168767
Submitted by:	Marcus von Appen <mva@freebsd.org>
a9682d1571
Marcus von Appen (mva) · 2.7.3_2
- Fix builds, if the NLS option switch is set. In some cases   expat-related modules are not built correctly.

PR:		ports/169276
Submitted by:	Greg Byshenk <freebsd@byshenk.net>
2f377af2d0
Marcus von Appen (mva) · 2.7.3_2
- Fix gettext detection for the locale module - Explicitly enable/disable gettext support via a new NLS OPTION switch.

PR:		ports/168684 ports/136917
On behalf of:	python@
b89f9ab26f
Marcus von Appen (mva) · 2.7.3_2
- unbreak WITH_PTH option support

PR:		ports/155936
Submitted by:	Kalten <kalten@gmx.at>
On behalf of:	python@
66adb13649
Dmitry Sivachenko (demon) · 2.7.3_2
Fix permissions for Tools and Demo folders.

PR:		152224
Submitted by:	John Hein <jhein@symmetricom.com>
Silence from:	python@
2b56d23731
Martin Wilke (miwi) · 2.7.3_2
- Revert back UCS changes
58183419a8
Martin Wilke (miwi) · 2.7.3_1
- Correct PYMALLOC logic (that fix the build of devel/gobject-introspection) - Remove old OPTION layout from py32 - Bump PORTREVISON
7e94fe3d3d
Martin Wilke (miwi) · 2.7.3
- Convert to new options framework

Reviewed by:	bapt
8c2c328510
Martin Wilke (miwi) · 2.7.3
- Update:   * python26 -> 2.6.8   * python27 -> 2.7.3   * python31 -> 3.1.5   * python32 -> 3.2.1

Security:	http://www.vuxml.org/freebsd/b4f8be9e-56b2-11e1-9fb7-003067b2972c.html
		CVE-2012-0845 CVE-2012-0876 CVE-2012-1150 CVE-2012-0845 CVE-2011-3389
19425757a8
Martin Wilke (miwi) · 2.7.2_4
- Mark Python as Secure - Fix DoS via malformed XML-RPC / HTTP POST

Submitted by:	rm@
Reported by:	many
Obtained from:	python hg
Security:	http://www.vuxml.org/freebsd/b4f8be9e-56b2-11e1-9fb7-003067b2972c.html
c70027929c
Martin Wilke (miwi) · 2.7.2_3
- Remove WITH_FBSD10_FIX, is no longer needed
e1c6649edf
Sunpoet Po-Chuan Hsieh (sunpoet) · 2.7.2_3
- Remove outdated patch to prune __wchar_t from CFLAGS (python-config --cflags) - Bump PORTREVISION for package change

PR:		ports/161564
Submitted by:	Nali Toja <nalitoja@gmail.com>
03ff71952d
Beat Gaetzi (beat) · 2.7.2_2
- Replace pre-configure target with WITH_FBSD10_FIX as we have a fix in   bsd.port.mk now.

Approved by:	miwi
2fbda21282
Erwin Lansing (erwin) · 2.7.2_2
Fix build on powerpc as is done on other python ports

Submitted by:	linimon
Tested on:	pointyhat
ce2f38ec49
Erwin Lansing (erwin) · 2.7.2_2
Fix build on FreeBSD 10

Submitted by:	beat
Tested on:	pointyhat i386-9-exp and i386-10
d7364df969
Li-Wen Hsu (lwhsu) · 2.7.2_2
- Remove the HUGE_STACK_SIZE option, now Python will use default   thread stack size of the system.
fc7b20b6d4
Dmitry Marakasov (amdmi3) · 2.7.2_1
- Add LDFLAGS to CONFIGURE_ENV and MAKE_ENV (as it was done with LDFLAGS) - Fix all ports that add {CPP,LD}FLAGS to *_ENV to modify flags instead

PR:		157936
Submitted by:	myself
Exp-runs by:	pav
Approved by:	pav
6f6fbe4bdf
Chris Rees (crees) · 2.7.2_1
Handle built world without NIS more gracefully; detect missing ypcat and  disable NIS module.

PR:		ports/115940
Submitted by:	Alex Deiter <tiamat@komi.mts.ru>
Reviewed by:	bf
d03cd9afc5
Li-Wen Hsu (lwhsu) · 2.7.2_1
- Fix pkg-plist when building with WITHOUT_THREADS

PR:		ports/159842
Submitted by:	Ruslan Mahmatkhanov <cvs-src@yandex.ru>
80b804c403
Sunpoet Po-Chuan Hsieh (sunpoet) · 2.7.2_1
- Clarify error message

PR:		ports/158812
Submitted by:	Warren Block <wblock@wonkity.com>
Reviewed by:	lwhsu
With Hat:	python
e35f6b3ffb
Wen Heping (wen) · 2.7.2_1
- Remove patch-Makefile.pre.in, now build with pthread correctly, bump PORTREVISION

Reported by:	rhurlin@gwdg.de (via email)
d08126833f
Wen Heping (wen) · 2.7.2
- Update to 2.7.2 - Mark BROKEN when build with pth

Reviewed by:	miwi@
d3a995e088
Mark Linimon (linimon) · 2.7.1_1
Enable build on powerpc64.  Tested on i386, no regression.

PR:		ports/155310
Submitted by:	andreast
Approved by:	lwhsu (python team)
674f8a50d0
Wen Heping (wen) · 2.7.1_1
- Fix the run error when build c extensions

PR:		ports/152671
Submitted by:	Milos Negovanovic <milos.negovanovic@gmail.com>
8ce9760c30
Wen Heping (wen) · 2.7.1
- Update to 2.7.1
91993cc40d
Wen Heping (wen) · 2.7.0_1
- Fix build to create _curses module correctly.

Submitted by:	olli@lurza.secnetix.de (via Email)
40d7ee37de
Li-Wen Hsu (lwhsu) · 2.7.0
- Introduce Python 2.7.0

Original work by:	wen
61b31f74b4
Wen Heping (wen) · 2.6.5
- Update lang/python26 to 2.6.5 - Update lang/python31 to 3.1.2

Reviewed by:	miwi@, lwhsu@
25e48ae956
Martin Wilke (miwi) · 2.6.4
- Update to 2.6.4

Changelog:
	http://python.org/download/releases/2.6.4/NEWS.txt
492dce90c8