PT-2023-9652 · Python+7 · Python+7

Delta Regeer

+2

·

Published

2023-07-11

·

Updated

2025-08-11

·

CVE-2023-41105

CVSS v2.0

7.8

High

VectorAV:N/AC:L/Au:N/C:N/I:C/A:N
Name of the Vulnerable Software and Affected Versions Python versions 3.11 through 3.11.4
Description The issue is related to the os.path.normpath() function, which truncates a path unexpectedly at the first '0' byte if such bytes are present in the path. This could lead to security issues, as filenames that would have been rejected for security reasons in earlier Python versions may no longer be rejected in Python 3.11.x. The vulnerability can be exploited by inserting null bytes into a path, potentially allowing a remote attacker to compromise the integrity of protected information. There are plausible cases where an application's allowlisting can be circumvented if a path with null bytes is constructed to pass the allowlist but then changes to the targeted resource after truncation.
Recommendations For Python versions 3.11 through 3.11.4, consider avoiding the use of the os.path.normpath() function with paths that may contain null bytes until a patch is available. As a temporary workaround, validate and sanitize paths before passing them to os.path.normpath() to prevent unexpected truncation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Untrusted Search Path

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

ALSA-2023:6494
ALSA-2023:7024
ALT-PU-2023-6199
BDU:2024-09261
BIT-LIBPYTHON-2023-41105
BIT-PYTHON-2023-41105
BIT-PYTHON-MIN-2023-41105
CESA-2023_7024
CVE-2023-41105
OPENSUSE-SU-2023_3943-1
OPENSUSE-SU-2024:13261-1
PSF-2023-9
RHSA-2023:6494
RHSA-2023:7024
RHSA-2023_6494
RHSA-2023_7024
SUSE-SU-2023:3939-1
SUSE-SU-2023:3943-1
USN-6547-1
USN-6891-1

Affected Products

Alt Linux
Almalinux
Centos
Linuxmint
Python
Red Hat
Suse
Ubuntu