PT-2020-16726 · Python+9 · Python+9

Published 2020-10-05 · Updated 2025-10-05 · CVE-2020-27619

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Python versions 3 through 3.9.0

Description The issue arises from the Lib/test/multibytecodec support.py CJK codec tests in Python, which call eval() on content retrieved via HTTP. This poses a risk due to the potential for executing arbitrary code.

Recommendations For Python versions 3 through 3.9.0, consider disabling the eval() function calls in the Lib/test/multibytecodec support.py CJK codec tests until a patch is available. Restrict access to the vulnerable CJK codec tests to minimize the risk of exploitation. Avoid using the eval() function on content retrieved via HTTP in the affected tests.

Exploit

Fix

Related Identifiers

ALSA-2021:4151

ALSA-2021:4162

ALT-PU-2021-1384

ALT-PU-2021-2420

ALT-PU-2021-2478

ALT-PU-2021-2653

ALT-PU-2024-3474

BIT-LIBPYTHON-2020-27619

BIT-PYTHON-2020-27619

BIT-PYTHON-MIN-2020-27619

CESA-2021_1633

CESA-2021_4151

CESA-2021_4162

CVE-2020-27619

MGASA-2020-0477

MGASA-2021-0327

OPENSUSE-SU-2020:2332-1

OPENSUSE-SU-2020:2333-1

OPENSUSE-SU-2020_2332-1

OPENSUSE-SU-2020_2333-1

OPENSUSE-SU-2024:11284-1

PSF-2020-6

RHSA-2021:1633

RHSA-2021:3252

RHSA-2021:3254

RHSA-2021:4151

RHSA-2021:4162

RHSA-2021_1633

RHSA-2021_4151

RHSA-2021_4162

RLSA-2021:4151

RLSA-2021:4162

SUSE-SU-2020:3865-1

SUSE-SU-2020:3930-1

SUSE-SU-2021:1621-1

USN-4754-1

USN-4754-2

USN-4754-3

USN-6891-1

Affected Products

Alt Linux

Almalinux

Centos

Debian

Linuxmint

Python

Red Hat

Rocky Linux

Suse

Ubuntu

References · 187

• 🔥 https://github.com/Einstein2150/CVE-2022-48565-POC · Exploit
• https://github.com/python/cpython/commit/6c6c256df3636ff6f6136820afaefa5a10a3ac33 · Vendor Advisory
• https://github.com/python/cpython/commit/b664a1df4ee71d3760ab937653b10997081b1794 · Vendor Advisory
• https://github.com/python/cpython/commit/43e523103886af66d6c27cd72431b5d9d14cd2a9 · Vendor Advisory
• https://github.com/python/cpython/commit/2ef5caa58febc8968e670e39e3d37cf8eef3cab8 · Vendor Advisory
• https://github.com/python/cpython/commit/e912e945f2960029d039d3390ea08835ad39374b · Vendor Advisory
• https://security.gentoo.org/glsa/202402-04 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-27619 · Security Note
• https://osv.dev/vulnerability/USN-6891-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4754-3 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-9674 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2021:4151 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3426 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-48566 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7 · Vendor Advisory