Bug 1860242 (CVE-2020-15801)
| Summary: | CVE-2020-15801 python: sys.path allowing code to be loaded from arbitrary locations | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Dhananjay Arunesh <darunesh> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED NOTABUG | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | adev88, bdettelb, carl, cstratak, dmalcolm, extras-orphan, hhorak, jeffrey.ness, jorton, jschorr, kevin, manisandro, m.cyprian, mhroncok, mplch, pviktori, python-maint, python-sig, rkuska, shcherbina.iryna, slavek.kabrda, steve.traylen, thrnciar, TicoTimo, tomckay, tomspur, torsava, vstinner |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-07-28 07:27:44 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1860243, 1860244, 1860245, 1860246, 1860247, 1860248, 1860250, 1860251, 1860252, 1860253, 1860254, 1860255 | ||
| Bug Blocks: | 1860249 | ||
|
Description
Dhananjay Arunesh
2020-07-24 06:12:34 UTC
Created mingw-python3 tracking bugs for this issue: Affects: fedora-all [bug 1860250] Created python2 tracking bugs for this issue: Affects: fedora-all [bug 1860246] Created python26 tracking bugs for this issue: Affects: fedora-all [bug 1860247] Created python27 tracking bugs for this issue: Affects: fedora-all [bug 1860251] Created python3 tracking bugs for this issue: Affects: fedora-all [bug 1860248] Created python34 tracking bugs for this issue: Affects: epel-all [bug 1860243] Affects: fedora-all [bug 1860253] Created python35 tracking bugs for this issue: Affects: fedora-all [bug 1860252] Created python36 tracking bugs for this issue: Affects: fedora-all [bug 1860254] Created python37 tracking bugs for this issue: Affects: fedora-all [bug 1860255] Created python38 tracking bugs for this issue: Affects: fedora-all [bug 1860245] The upstream issue suggests this is only affecting Windows. The _pth feature for sys.path restrictions is Windows-specific. And mingw-python3 doesn't use the affected releases. This applies to Windows embedded distribution, see here: https://docs.python.org/3.6/using/windows.html#embedded-distribution >To completely override sys.path, create a ._pth file with the same name as the DLL (python36._pth) or the executable (python._pth) and specify one >line for each path to add to sys.path. The file based on the DLL name overrides the one based on the executable, which allows paths to be restricted >for any program loading the runtime if desired. And getpathp.c says at the top: >Used by DOS, Windows 3.1, Windows 95/98, Windows NT. As mentioned above this is specific to Windows and does not affect versions of Python as shipped with RHEL or Red Hat Software Collections. This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-15801 Statement: This flaw does not affect versions of python shipped with Red Hat Enterprise Linux, Red Hat Software Collections or Red Hat Quay; the vulnerable code exists in a module specific to Microsoft Windows deployment. |