[SECURITY] [DLA 4354-1] pypy3 security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4354-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Andrej Shadura
October 31, 2025 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : pypy3
Version : 7.3.5+dfsg-2+deb11u5
CVE ID : CVE-2024-6232 CVE-2024-6923 CVE-2024-7592 CVE-2024-11168
CVE-2025-0938 CVE-2025-1795 CVE-2025-6069 CVE-2025-8291
This upload fixes a few of security issues in the Python standard library
included with PyPy, an alternative implementation of the Python 3 language.
CVE-2024-6232
The tarfile module used to parse tar parsed header values with regular
expressions that allowed for backtracking, which could be used to cause
denial of service via specifically-crafted tar archives (ReDoS). Since
tar headers have a well-known format that doesn't require backtracking
to parse reliably, the new method of parsing only requires a single pass
over a byte stream.
CVE-2024-6923
The email module didn’t properly quote newlines when serialising
email messages, which could be used to inject newlines that would
affect the interpretation of the email headers. An attacker could
cause some email headers to be completely skipped or potentially
hide malicious headers within other headers.
CVE-2024-7592
The http.cookies, when parsing cookies that contained backslashes
for quoted characters in the cookie value, would use an algorithm
with quadratic complexity, resulting in excess CPU resources being
used while parsing the value. E.g. parsing a 20000+ byte cookie
would take about a second (ReDoS).
CVE-2024-11168 and CVE-2025-0938
The urllib.parse.urlsplit and urlparse functions improperly validated
domain names that included square brackets allowing hosts that
weren't IPv6 or IPvFuture.
CVE-2025-1795
In the email module, during an address list folding, when a separating
comma ended up on a folded line and that line is to be Unicode-encoded,
then the separator itself was also Unicode-encoded. Expected behavior
is that the separating comma remains a plan comma. This could result
in the address header being misinterpreted by some mail servers.
CVE-2025-6069
The html.parser.HTMLParser class had worse-case quadratic complexity
when processing certain crafted malformed inputs potentially leading
to amplified denial-of-service.
CVE-2025-8291
The zipfile module would not check the validity of the ZIP64 End of
Central Directory (EOCD).
Locator record offset value would not be used to locate the ZIP64
EOCD record, but instead the ZIP64 EOCD record would be assumed
to be the previous record in the ZIP archive. This could be abused
to create ZIP archives that are handled differently by the zipfile
module compared to other ZIP implementations. Remediation maintains
this behavior, but checks that the offset specified in the ZIP64
EOCD Locator record matches the expected value.
For Debian 11 bullseye, these problems have been fixed in version
7.3.5+dfsg-2+deb11u5.
We recommend that you upgrade your pypy3 packages.
For the detailed security status of pypy3 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/pypy3
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----
iHUEARYKAB0WIQSD3NF/RLIsyDZW7aHoRGtKyMdyYQUCaQRmVQAKCRDoRGtKyMdy
YZ7uAQDJYcRn/ljnSQKukfrLjO+31NX7JmEZFRFxTZvGUNS3GQD/YXiuzm6L9Kyo
CyM7Xmju6UCl4JjmRMdWa7ateNnt9wE=
=2vjt
-----END PGP SIGNATURE-----
Reply to: