BSD PortsPython -- poplib module, when passed a user-controlled command, can have additional commands injected using newlines
· CVE-2025-15367 · VuXML entry
Python Software Foundation Security Developer reports: The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.
Affected versions
- python310 >= 0
- python311 >= 0
- python312 >= 0
- python313 >= 0
- python313t >= 0
- python314 >= 0
- python314t >= 0
- python315 < 3.15.0.a6
By system
15 still vulnerable, 0 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | lang/python310 | 3.10.17_1 | vulnerable since 2026-04-01 | |
| NetBSD | lang/python310 | 3.10.21 | listed since 2026-04-01 | |
| GhostBSD | lang/python310 | 3.10.21 | vulnerable since 2026-04-01 | |
| DragonFly | lang/python311 | 3.11.12_1 | vulnerable since 2026-04-01 | |
| NetBSD | lang/python311 | 3.11.16 | listed since 2026-04-01 | |
| MidnightBSD | lang/python311 | in range, by version | ||
| FreeBSD | lang/python311 | 3.11.17 | vulnerable since 2026-04-01 | |
| FreeBSD | lang/python312 | 3.12.15 | vulnerable since 2026-04-01 | |
| NetBSD | lang/python312 | 3.12.14 | listed since 2026-04-01 | |
| MidnightBSD | lang/python312 | in range, by version | ||
| FreeBSD | lang/python313 | 3.13.16 | vulnerable since 2026-04-01 | |
| NetBSD | lang/python313 | 3.13.15 | listed since 2026-04-01 | |
| MidnightBSD | lang/python313 | in range, by version | ||
| FreeBSD | lang/python313t | 3.13.16 | vulnerable since 2026-04-01 | |
| MidnightBSD | lang/python313t | in range, by version | ||
| FreeBSD | lang/python314 | 3.14.8 | vulnerable since 2026-04-01 | |
| NetBSD | lang/python314 | 3.14.7 | listed since 2026-04-01 | |
| MidnightBSD | lang/python314 | in range, by version | ||
| FreeBSD | lang/python314t | 3.14.8 | vulnerable since 2026-04-01 | |
| FreeBSD | lang/python315 | 3.15.0 | vulnerable since 2026-04-01 | |
| MidnightBSD | lang/python315 | in range, by version |