PT-2022-3252 · Python+11 · Python+11
Bernd Dietzel
·
Published
2015-08-02
·
Updated
2026-05-18
·
CVE-2015-20107
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Python versions prior to 3.10.8
Python versions 3.7, 3.8, 3.9
Description
The issue is related to insufficient argument validation in the mailcap module of the Python interpreter. This may allow a remote attacker to inject shell commands into applications that use the mailcap.findmatch function with untrusted input, such as unvalidated user-provided filenames or arguments.
Recommendations
For Python versions prior to 3.10.8, update to version 3.10.8 or later to resolve the issue.
For Python versions 3.7, 3.8, 3.9, apply the back-ported fix to resolve the issue.
As a temporary workaround, consider validating user-provided filenames and arguments before passing them to the mailcap.findmatch function to minimize the risk of exploitation.
Exploit
Fix
Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Debian
Linuxmint
Python
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu