Use ldconfig to check for libc_r, not an absolute path. Thread support should now be compiled in on -current. Suggested by: Jacques Vidrineed9f74ade1
Port details
lang/python272.7.18_5
Interpreted object-oriented programming language
- Maintainer
- python@FreeBSD.org
- Packages
- python27 2.7.18_5
- Upstream
- Higher version available: 3.15.1
- CPE
python:pythonfrom the port- WWW
- https://www.python.org/
- Links
- cgit · VuXML
Unaddressed (33) · The CVE record lists this version as affected, no VuXML entry names the CVE
Updating to 3.13.14 would fix 27 of 33 unaddressed CVEs, according to the CVE records.
Fixed up to each version, cumulative: 3.9.21 15 · 3.10.0 16 · 3.10.20 17 · 3.10.21 19 · 3.13.10 21 · 3.13.11 22 · 3.13.13 25 · 3.13.14 27
| CVE-2022-48565 | 9.8 | 2023-08-22 | An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vuln… |
| CVE-2007-4559 | 9.8 | 2007-08-28 | Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbi… |
| CVE-2017-17522 | 8.8 | 2017-12-14 | Lib/webbrowser.py in Python through 3.6.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote … |
| CVE-2026-15308 | 8.7 | 2026-07-09 | The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data. |
| CVE-2024-6232 | 7.5 | 2024-09-03 | There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulner… |
| CVE-2024-7592 | 7.5 | 2024-08-19 | There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for q… |
| CVE-2022-48560 | 7.5 | 2023-08-22 | A use-after-free exists in Python through 3.9 via heappushpop in heapq. |
| CVE-2023-36632 | 7.5 | 2023-06-25 | The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger "RecursionError: maximum recursion depth exceeded while calling a Python o… |
| CVE-2023-24329 | 7.5 | 2023-02-17 | An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters. |
| CVE-2022-45061 | 7.5 | 2022-11-09 | An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such t… |
| CVE-2022-0391 | 7.5 | 2022-02-09 | A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involv… |
| CVE-2026-4519 | 7.0 | 2026-03-20 | The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading … |
| CVE-2022-48564 | 6.5 | 2023-08-22 | read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property List files i… |
| CVE-2021-3733 | 6.5 | 2022-03-10 | There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could … |
| CVE-2017-18207 | 6.5 | 2018-03-01 | The Wave_read._read_fmt_chunk function in Lib/wave.py in Python through 3.6.4 does not ensure a nonzero channel value, which allows attackers to cause a denial of servic… |
| CVE-2026-7210 | 6.3 | 2026-05-11 | `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding… |
| CVE-2025-12781 | 6.3 | 2026-01-21 | When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be accepted, regardl… |
| CVE-2025-12084 | 6.3 | 2025-12-03 | When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability ca… |
| CVE-2025-13836 | 6.3 | 2025-12-01 | When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause … |
| CVE-2026-3087 | 6.0 | 2026-04-27 | If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target di… |
| CVE-2026-4224 | 6.0 | 2026-03-16 | When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs. |
| CVE-2026-3644 | 6.0 | 2026-03-16 | The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patc… |
| CVE-2022-48566 | 5.9 | 2023-08-22 | An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possible in the accumulator variable in hmac… |
| CVE-2021-23336 | 5.9 | 2021-02-15 | The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache P… |
| CVE-2024-9287 | 5.3 | 2024-10-22 | A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the … |
Show all 33
| CVE-2023-40217 | 5.3 | 2023-08-25 | An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers… |
| CVE-2023-27043 | 5.3 | 2023-04-19 | The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as t… |
| CVE-2026-0864 | 4.1 | 2026-06-23 | When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be inje… |
| CVE-2026-6019 | 2.1 | 2026-04-22 | http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive seq… |
| CVE-2025-13837 | 2.1 | 2025-12-01 | When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues |
| CVE-2026-4360 | 2.0 | 2026-06-30 | In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar fil… |
| CVE-2025-13462 | 2.0 | 2026-03-12 | The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE… |
| CVE-2025-6075 | 1.8 | 2025-10-31 | If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables. |
VuXML only (0) · listed, port not fixed yet
None.
pkg audit reports nothing for this version.Fixed (10)
Show 10 fixed
VuXML entries whose affected range this version has left.
Python -- Regular Expression DoS attack against cliententered 2020-04-23
Python -- NULL pointer dereference vulnerabilityentered 2019-03-26
python 2.7 -- multiple vulnerabilitiesentered 2018-05-05
CVE-2012-0876, CVE-2016-0718, CVE-2016-4472, CVE-2016-9063, CVE-2017-9233, CVE-2018-1060, CVE-2018-1061
Python 2.7 -- multiple vulnerabilitiesentered 2017-10-11
CVE-2012-0876, CVE-2016-0718, CVE-2016-4472, CVE-2016-5300, CVE-2016-9063, CVE-2017-9233
Python -- smtplib StartTLS stripping vulnerabilityentered 2016-07-03
Python -- HTTP Header Injection in Python urllibentered 2016-06-30
Python -- Integer overflow in zipimport moduleentered 2016-06-17
Python -- buffer overflow in socket.recvfrom_into()entered 2014-03-01
Python -- DoS via malformed XML-RPC / HTTP POST requestentered 2012-02-14
Commits (342)
Add virtual category "python". pygist: add dependency on rng.ad0b1faa57
Pick up latest official patches.7badc319ae
plat-freebsd3 doesn't have a regen script. Noticed by: Gianmarco Giovannelli <gmarco@scotty.masternet.it>e7ec8346d7
Add latest official patches.48da0b17e4
Include latest official patches.c1481205a8
Don't throw away OS version number, some scripts need it. Pick up latest official patches while I'm here.82deb06f14
Bring in latest official patches. Use `-pthread' to avoid linking with libc in the threaded interpreter.fff48ed187
Add new official patches and activate the dl module.be73fc6e37
Include official patches.6249aa321c
Upgrade to 1.5.1.69dc0df901
Use the combined set of patches.65ecc177a9
Include official patches.93351faa89
Use -D_THREAD_SAFE when compiling the threaded version.98753c4bbb
Use tk80, not an unsupported alpha version of tk81. Include locale module.006ffd57de
Upgrade to use tcl8.1 and tk8.1.3d4a5438d3
Make python work with threads again. Looks like our libc_r implements an older draft of the pthread standard.dccefb8a4b
Upgrade to 1.5.9d49792924
Use an option to disable the Tk extension (WITH_TK). Don't use libc_r if we're not building the thread module. Respect options given in the environment. The defaults (build with Tk and thread support) don't change.3876bae11f
Use tk-8.0. Minor makefile cleanups. Add some `@dirrm's in PLIST.8f042a171a
Fix tk-4.1 dependency. While I'm here, add libreadline support.84dd2a8a1b
Compile with thread support, if libc_r exists and WITH_THREADS is set. Submitted by: Peter Haight <peterh@prognet.com>4325223d81
Some reorganization of this port: - build some modules as shared objects, reducing the interpreter's size and removing the dependency on tix - install shared objects in lib - remove version number from OS-dependent script dir A new port of PyTix will follow shortly.5866f48b31
Add NumPy to default search path.fb75e8f866
Add virtual category 'tk41'.1760fd6654
Use new libtix.77f3c73aa7
Install config.h, so compiling extensions from C sources actually works.a80debf805
Compile in the PyTix extensions, now that we have Tix. Change MAINTAINER from jkh to tg. OK'd by: Jordan.1af0ec6bf0
Converted to MAN[1-9NL]322557b38b
CATAGORIES+= -> CATAGORIES= Reordered vars where needed. Added MAINTAINERS where needed, many mkdir --> ${MKDIR}, install -> ${INSTALL_*}, etc.d23a795680Update to version 1.4 Submitted-By: Thomas Gellekum <thomas@ghpc8.ihf.rwth-aachen.de>cacf671ae3
Remove LIB_DEPENDS on tcl75, it seems to compile and run fine using the tcl library in /usr/lib.0842552d47
Make python install include files. Reviewed by: jkh9e307c4661
Upgrade this port to use the latest tcl/tk. Patches Submitted by: Soren Dayton <soren@ambiguity.i-2.com>89ab16ba94
Ah, missed the extra patches. Also revert PLIST to use share instead of lib again.471acf84eb
share -> lib; thanks, Satoshi!cf0cb0bcf2
Update to Python 1.3 Submitted by: tg6534821fdb
Change category nome from "languages" to "lang". Also remove "programming" which appeared in some of them, everything here is a programming language! :)5812de6cad
Shorten the comments.979b9a5bf7
List all files in lib/python, plus one @exec/unexec mkdir/rmdir pair for an empty directory.17a5eef585
A little cleanup, move things around to correct order, put MAINTAINER=jkh@freebsd.org in a separate line so that people know who to yell at, etc.2552437481
The Python programming language.9b2f64d776