Affected: Python Software Foundation CPython

If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.

security update for python3.9

python: Invalid value for OpenSSL API may cause Buffer over-read when NPN is used systemd-coredump: race condition that allows a local attacker to crash a SUID program and gain read access to the resulting core dump cpython: Python HTMLParser quadratic complexity python: Quadratic complexity in os.path.expandvars() with user-controlled template cpython: python: Python zipfile End of Central Directory (EOCD) Locator record offset not checked libxslt: libxml2: Inifinite recursion at exsltDynMapFunction function in libexslt/dynamic.c node-forge: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications qs: qs: Denial of Service via improper input validation in array parsing tar: Tar path traversal firefox: thunderbird: expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing django: Potential partial directory-traversal via archive.extract() openssh: OpenSSH: Control characters in usernames can lead to code execution via ProxyCommand openssh: OpenSSH: Null character in ssh:// URI can lead to code execution via ProxyCommand Django: Django: Algorithmic complexity in XML Deserializer leads to denial of service libpng: LIBPNG buffer overflow glob: glob: Command Injection Vulnerability via Malicious Filenames libpng: LIBPNG heap buffer overflow node-forge: node-forge ASN.1 Unbounded Recursion libpng: LIBPNG out-of-bounds read in png_image_read_composite urllib3: urlli…