Bug 2075390 (CVE-2015-20107)
| Summary: | CVE-2015-20107 python: mailcap: findmatch() function does not sanitize the second argument | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Sandipan Roy <saroy> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | carl, cstratak, hhorak, jorton, manisandro, mhroncok, pviktori, python-maint, python-sig, security-response-team, thrnciar, TicoTimo, torsava, vstinner |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
A command injection vulnerability was found in the Python mailcap module. The issue occurs due to not adding escape characters into the system mailcap file commands. This flaw allows attackers to inject shell commands into applications that call the mailcap.findmatch function with untrusted input.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2022-12-05 01:32:53 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2076507, 2076508, 2076509, 2076510, 2076511, 2076512, 2076513, 2076514, 2076515, 2076516, 2076526, 2076530, 2076531, 2076532, 2076533, 2077865, 2077866, 2077867, 2077868, 2077869, 2077871, 2077872, 2077873, 2077874, 2077875, 2077876, 2077877, 2084457, 2125237 | ||
| Bug Blocks: | 2075391 | ||
|
Description
Sandipan Roy
2022-04-14 05:03:43 UTC
Public announcement: https://mail.python.org/archives/list/security-announce@python.org/thread/QDSXNCW77UGULFG2JMDFZQ7H4DIR32LA/ Created mingw-python3 tracking bugs for this issue: Affects: fedora-all [bug 2076508] Created python2.7 tracking bugs for this issue: Affects: fedora-all [bug 2076509] Created python3.10 tracking bugs for this issue: Affects: fedora-all [bug 2076510] Created python3.11 tracking bugs for this issue: Affects: fedora-all [bug 2076511] Created python3.5 tracking bugs for this issue: Affects: fedora-all [bug 2076512] Created python3.6 tracking bugs for this issue: Affects: fedora-all [bug 2076513] Created python3.7 tracking bugs for this issue: Affects: fedora-all [bug 2076514] Created python3.8 tracking bugs for this issue: Affects: fedora-all [bug 2076515] Created python3.9 tracking bugs for this issue: Affects: fedora-all [bug 2076516] Created python34 tracking bugs for this issue: Affects: epel-all [bug 2076507] Created pypy3 tracking bugs for this issue: Affects: fedora-34 [bug 2076526] Created pypy tracking bugs for this issue: Affects: fedora-all [bug 2076533] Created pypy3.7 tracking bugs for this issue: Affects: fedora-all [bug 2076530] Created pypy3.8 tracking bugs for this issue: Affects: fedora-all [bug 2076531] Created pypy3.9 tracking bugs for this issue: Affects: fedora-all [bug 2076532] Here's a possible solution -- make mailcap fail to match with unsafe filenames: https://github.com/python/cpython/pull/91993 WDYT? This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:6457 https://access.redhat.com/errata/RHSA-2022:6457 This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Via RHSA-2022:6766 https://access.redhat.com/errata/RHSA-2022:6766 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:7581 https://access.redhat.com/errata/RHSA-2022:7581 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:7592 https://access.redhat.com/errata/RHSA-2022:7592 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:7593 https://access.redhat.com/errata/RHSA-2022:7593 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2022:8353 https://access.redhat.com/errata/RHSA-2022:8353 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2015-20107 |