All errata/sisyphus_mipsel/ALT-PU-2022-5238-1
ALT-PU-2022-5238-1

Package update python in branch sisyphus_mipsel

Version2.7.18-alt10
Task#0
Published2022-06-19
Max severityCRITICAL
Severity:

Closed issues (2)

BDU:2022-03962
CRITICAL9.8

Уязвимость модуля mailcap интерпретатора языка программирования Python, позволяющая нарушителю выполнить произвольную команду

Published: 2022-06-29Modified: 2025-11-05
CVSS 3.xCRITICAL 9.8
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0CRITICAL 10.0
CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
References
CVE-2015-20107
HIGH7.6

In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9

Published: 2022-04-13Modified: 2025-11-03
CVSS 2.0HIGH 8.0
CVSS:2.0/AV:N/AC:L/Au:S/C:P/I:C/A:P
CVSS 3.xHIGH 7.6
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
References