ALT-PU-2022-7348-1

Package update python3 in branch sisyphus_riscv64

Version3.10.8-alt1

Task#0

Published2022-12-07

Max severityCRITICAL

Severity:

Closed issues (2)

CRITICAL9.8

Уязвимость модуля mailcap интерпретатора языка программирования Python, позволяющая нарушителю выполнить произвольную команду

Published: 2022-06-29Modified: 2025-11-05

CVSS 3.xCRITICAL 9.8

CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS 2.0CRITICAL 10.0

CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C

References

CVE-2015-20107

HIGH7.6

In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9

Published: 2022-04-13Modified: 2025-11-03

CVSS 2.0HIGH 8.0

CVSS:2.0/AV:N/AC:L/Au:S/C:P/I:C/A:P

CVSS 3.xHIGH 7.6

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

References