VAITP Dataset

Dataset Statistics

> Vulnerability Details

Vulnerability:

Description:

ODC:

ODC taxonomy:

Code Defects Classification	Fault Nature	Example
Function	Missing Functionality	A new function or functionality in an existing function is missing
	Incorrect Functionality	Part of the function code structure needs to be altered
	Extraneous Functionality	Functionality that is actually not needed
Interface	Missing Interface	A parameter is missing in a function call
	Incorrect Interface	Incorrect information was passed to a function call
	Extraneous Interface	Surplus data was passed to a function call
Checking	Missing Check	Conditional logic is missing
	Incorrect Check	Incorrect logic used
	Extraneous Check	Superfluous logic should not be present
Assignment	Missing Assignment	A variable was not assigned a value or not initialized
	Incorrect Assignment	An incorrect value was assigned to a variable
	Extraneous Assignment	A variable should not have been assigned
Timing/Serialization	Timing Issues	Thread issues or race conditions
	Serialization Issues	Incorrect serialization operations
	Extraneous Serialization	Superfluous serialization
Build/Package/Merge	Building Issues	Undefined reference to function
	Packaging Issues	Conflict of dependency versions
	Merging Conflicts	Two branches of a git changed the same line of code
Algorithm	Missing Algorithm	Part of the algorithm is missing
	Incorrect Algorithm	Algorithm is not correctly coded
	Extraneous Algorithm	Algorithm has superfluous code

Category:

Subcategory:

CVEs:

CWEs:

References:

Solution:

Available Python Code:

Dataset Explorer

Vulnerable entries

Patched entries

Vulnerable Python Code

# VAITP - Vulnerability Attack and Injection Tool for Python
										# Select a vulnerable file from the explorer

Patched Python Code

# VAITP - Vulnerability Attack and Injection Tool for Python
										# Select a patched file from the explorer

Search for CVE

CVE

Vulnerability

ODC

Category

Subcategory

Accessibility Scope

Details

Total vulnerabilities in the dataset (not showing ignored and non-python related vulnerabilties): 1612

CVE-2023-27043

Incorrect parsing of e-mail addresses in Python email module

The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python.

Function

Input Validation and Sanitization

Insecure Parsing or Deserialization

Remote

CVE-2023-38898

Sensitive information exposure in _asyncio._swap_current_task

An issue in Python cpython v.3.7 allows an attacker to obtain sensitive information via the _asyncio._swap_current_task component.

Timing/Serialization

Information Leakage

Insecure Handling of Sensitive Data

Local

« Previous 161162

Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.

The supreme art of war is to subdue the enemy without fighting.
Sun Tzu – “The Art of War”

:: Shaping the future through research and ingenuity ::

VAITP

Newsletter Signup

Quick Links

Community Word

VAITP Dataset

Please set your Metamask wallet address before proposing changes!

Available Python Code:

Dataset Explorer

Vulnerable Python Code

Patched Python Code

Legal Disclaimer