CVE-2012-2135 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2135): The utf-16 decoder in Python 3.1 through 3.3 does not update the aligned_end variable after calling the unicode_decode_call_errorhandler function, which allows remote attackers to obtain sensitive information (process memory) or cause a denial of service (memory corruption and crash) via unspecified vectors. http://bugs.python.org/issue14579
CVE-2011-4944 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4944): Python 2.6 through 3.2 creates ~/.pypirc with world-readable permissions before changing them after data has been written, which introduces a race condition that allows local users to obtain a username and password by reading this file.
2.6: affects <=2.6.5. Nothing vulnerable in tree. 2.7: affects <=2.7.2. Nothing vulnerable in tree. 3.0: irrelevant. 3.1: affects 3.1.5, but that's masked for removal. 3.2: affects =3.2. Nothing vulnerable. 3.3: unaffected. @security team: worth a GLSA at this point?
(In reply to Chris Reffett from comment #2) > 2.6: affects <=2.6.5. Nothing vulnerable in tree. > 2.7: affects <=2.7.2. Nothing vulnerable in tree. > 3.0: irrelevant. > 3.1: affects 3.1.5, but that's masked for removal. > 3.2: affects =3.2. Nothing vulnerable. > 3.3: unaffected. > > @security team: worth a GLSA at this point? As you said there is nothing to remove. The p.mask for 3.1.5 is enough.
Covered by GLSA 201401-04 Closing as fixed