Security Considerations
The following modules have specific security considerations:
cgi
: CGI security considerationshashlib
: all constructors take a “usedforsecurity” keyword-only argument disabling known insecure and blocked algorithmshttp.server
is not suitable for production use, only implementing basic security checks. See the security considerations.logging
: Logging configuration uses eval()multiprocessing
: Connection.recv() uses picklepickle
: Restricting globals in picklerandom
shouldn’t be used for security purposes, usesecrets
insteadshelve
: shelve is based on pickle and thus unsuitable for dealing with untrusted sourcesssl
: SSL/TLS security considerationssubprocess
: Subprocess security considerationstempfile
: mktemp is deprecated due to vulnerability to race conditionsxml
: XML vulnerabilitieszipfile
: maliciously prepared .zip files can cause disk volume exhaustion