Debian 10 Buster DLA-3432-1 Moderate: Python2.7 Command Injection

CVE-2015-20107

The mailcap module does not add escape characters into commands
discovered in the system mailcap file. This may allow attackers to
inject shell commands into applications that call
mailcap.findmatch with untrusted input (if they lack validation of
user-provided filenames or arguments).

CVE-2019-20907

In Lib/tarfile.py, an attacker is able to craft a TAR archive
leading to an infinite loop when opened by tarfile.open, because
_proc_pax lacks header validation.

CVE-2020-8492

Python allows an HTTP server to conduct Regular Expression Denial
of Service (ReDoS) attacks against a client because of
urllib.request.AbstractBasicAuthHandler catastrophic backtracking.

CVE-2020-26116

http.client allows CRLF injection if the attacker controls the
HTTP request method, as demonstrated by inserting CR and LF
control characters in the first argument of
HTTPConnection.request.

CVE-2021-3177