PT-2023-27523 · Pyramid+3 · Pyramid+5

Mattia Verga · Published 2023-08-25 · Updated 2024-04-08 · CVE-2023-40587

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pyramid versions 2.0.0 through 2.0.1

Description A path traversal vulnerability impacts users of Python 3.11 that are using a Pyramid static view with a full filesystem path and have a index.html file located exactly one directory above the location of the static view's file system path. No further path traversal exists, and the only file that could be disclosed accidentally is index.html. The issue is related to the os.path.normpath function in Python 3.11, which truncates on the first 0x00 found. This behavior has been fixed in Python 3.12 and will be available in Python 3.11.5.

Recommendations For Pyramid versions 2.0.0 and 2.0.1, use a version of Python 3 that is not affected, downgrade to Python 3.10 series temporarily, or wait until Python 3.11.5 is released and upgrade to the latest version of Python 3.11 series. As a temporary workaround, consider avoiding the use of null-bytes in directory and file names. Restrict access to the index.html file located above the static view's file system path to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

ALT-PU-2023-8423

CVE-2023-40587

GHSA-J8G2-6FC7-Q8F8

Affected Products

Alt Linux

Debian

Pyramid

Python 3.10

Python 3.11

Python 3.12

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40587.json · Exploit
• https://github.com/python/cpython/pull/106816 · Patch
• https://github.com/Pylons/pyramid/commit/347d7750da6f45c7436dd0c31468885cc9343c85 · Patch
• https://github.com/Pylons/pyramid/security/advisories/GHSA-j8g2-6fc7-q8f8 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-40587 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/OQIPHQTM3XE5NIEXCTQFV2J2RK2YUSMT · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-40587 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-40587 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/LYSDTQ7NP5GHPQ7HBE47MBJQK7YEIYMF · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-40587 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j8g2-6fc7-q8f8 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-40587 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-40587 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-40587 · Vendor Advisory
• https://github.com/python/cpython/issues/106242 · Note