Python Security Updates: 3.12.14, 3.11.16, and 3.10.21 Patch tarfile Bypasses and DoS Vectors
Python's core team has released security-only source-only updates for Python 3.10.21, 3.11.16, and 3.12.14, confirming all three versions are now in maintenance mode with no further release cadence. The updates prioritize critical path traversal bypasses in tarfile and ZIP extraction on Windows, while also blocking remote code execution vectors in webbrowser, cookie handling, and WSGI status fields. Denial-of-service protections have been strengthened against exponential complexity attacks in csv, HTML parsing, and XML modules, complemented by a bundle update to libexpat 2.8.3 for improved billion laughs and hash flooding defenses. Users should upgrade immediately, especially those processing untrusted archives or structured data, as these patches address high-severity CVEs including a tarfile link-target escape and cookie control character injection.
Python Security Updates: 3.12.14, 3.11.16, and 3.10.21 Patch tarfile Bypasses and DoS Vectors
Python's core team has released security-only updates for versions 3.10.21, 3.11.16, and 3.12.14, focusing on critical vulnerabilities related to path traversal bypasses in the tarfile module and denial-of-service (DoS) vectors. These updates patch various issues, including remote code execution risks in web browsers and cookie handling, and strengthen protections against DoS attacks in multiple modules such as CSV, XML, and HTML parsing. Additionally, memory safety improvements have been made, addressing potential vulnerabilities in bz2, lzma, and zlib decompression processes. Users are urged to upgrade immediately, particularly those handling untrusted archives or structured data, as these patches resolve high-severity vulnerabilities
