python-security
Safeguard articles tagged "python-security" — guides, analysis, and best practices for software supply chain and application security.
96 articles
CVE-2020-35655: Decompression bomb DoS in Pillow
A crafted image file could force Pillow to over-allocate memory, causing denial of service. Here's what CVE-2020-35655 affects, its severity, and how to remediate it.
CVE-2023-50447: Arbitrary code execution via Pillow Image...
A patch bypass in Pillow's ImageMath.eval() reopens arbitrary code execution first flagged in CVE-2022-22817. Here's what changed and how to remediate it.
CVE-2019-1010083: Denial of service in Flask via large mu...
CVE-2019-1010083 let attackers crash Flask apps with crafted multipart requests. Here's the impact, affected versions, and how to remediate the DoS flaw.
CVE-2023-25577: Denial of service in Werkzeug multipart p...
CVE-2023-25577 lets attackers trigger denial of service in Werkzeug's multipart parser via crafted uploads. Here's the impact, timeline, and fix.
CVE-2020-10108: Cross-protocol scripting in Twisted
CVE-2020-10108 lets a malicious server abuse Twisted's redirect handling for cross-protocol scripting. Affected versions, risk context, and fixes inside.
CVE-2020-10109: Denial of service in Twisted via 100-cont...
CVE-2020-10109 lets attackers hang Twisted's HTTP server with malformed 100-continue requests, exhausting resources until it stops responding.
CVE-2021-43818: XSS bypass in lxml Cleaner
CVE-2021-43818 shows how crafted SVG markup could slip past lxml's Cleaner sanitizer and execute script in supposedly 'cleaned' HTML output.
CVE-2020-27783: Cross-site scripting bypass in lxml html ...
CVE-2020-27783 lets attackers bypass lxml's html.clean.Cleaner sanitizer to smuggle XSS past HTML cleaning. Here's what's affected and how to remediate it.
CVE-2018-7750: Authentication bypass in paramiko SSH serv...
CVE-2018-7750 lets attackers bypass authentication on Paramiko SSH servers using interactive auth by forging a success message. Impact, timeline, and fixes inside.
CVE-2022-42919: Python's multiprocessing Privilege Escalation Explained
A local privilege escalation in Python's multiprocessing forkserver on Linux. Here is what CVE-2022-42919 does, which versions are affected, and how to remediate.
Encryption and Decryption in Python: A Practical Guide
Encryption in Python is easy to get working and surprisingly easy to get wrong — here's how to do symmetric and asymmetric encryption correctly using the cryptography library instead of rolling your own.
Securing LangChain and LlamaIndex Applications in Production
Agent frameworks ship fast and patch fast. The CVE history, the dangerous defaults, and a production hardening baseline for LangChain and LlamaIndex apps.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.