PT-2023-9652 · Python+7 · Python+7
Delta Regeer
+2
·
Published
2023-07-11
·
Updated
2025-08-11
·
CVE-2023-41105
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
Python versions 3.11 through 3.11.4
Description
The issue is related to the
os.path.normpath() function, which truncates a path unexpectedly at the first '0' byte if such bytes are present in the path. This could lead to security issues, as filenames that would have been rejected for security reasons in earlier Python versions may no longer be rejected in Python 3.11.x. The vulnerability can be exploited by inserting null bytes into a path, potentially allowing a remote attacker to compromise the integrity of protected information. There are plausible cases where an application's allowlisting can be circumvented if a path with null bytes is constructed to pass the allowlist but then changes to the targeted resource after truncation.Recommendations
For Python versions 3.11 through 3.11.4, consider avoiding the use of the
os.path.normpath() function with paths that may contain null bytes until a patch is available. As a temporary workaround, validate and sanitize paths before passing them to os.path.normpath() to prevent unexpected truncation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Untrusted Search Path
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Linuxmint
Python
Red Hat
Suse
Ubuntu