PT-2009-1458 · Python+1 · Python+1

Jan Lieskovsky · Published 2009-01-28 · Updated 2022-07-05 · CVE-2008-5983

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Python versions 2.6 and earlier

Description The issue is related to an untrusted search path vulnerability in the PySys SetArgv API function. When the argv[0] argument does not contain a path separator, an empty string is prepended to sys.path. This might allow local users to execute arbitrary code via a Trojan horse Python file in the current working directory.

Recommendations For Python versions 2.6 and earlier, consider updating to a version where this issue is resolved, or as a temporary workaround, restrict the execution of Python files from untrusted sources in the current working directory to minimize the risk of exploitation.

Fix

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

CVE-2008-5983

RHSA-2011:0027

RHSA-2011_0027

Affected Products

Python

Red Hat

References · 33

• http://security.gentoo.org/glsa/glsa-200904-06.xml · Vendor Advisory
• http://ubuntu.com/usn/USN-1613-1 · Vendor Advisory
• http://ubuntu.com/usn/USN-1613-2 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2011-0027.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2010-June/042751.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-5983 · Security Note
• http://ubuntu.com/usn/USN-1596-1 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200903-41.xml · Vendor Advisory
• http://ubuntu.com/usn/USN-1616-1 · Vendor Advisory
• https://t.me/cvenotify/32628 · Telegram Post
• http://mail-archive.com/debian-bugs-dist%40lists.debian.org/msg586010.html · Note
• http://secunia.com/advisories/51040 · Note
• http://secunia.com/advisories/34522 · Note
• https://access.redhat.com/security/cve/CVE-2010-1449 · Note
• http://openwall.com/lists/oss-security/2009/01/28/5 · Note