PT-2025-6639 · Python · Cpython

Seth Larson · Published 2025-02-14 · Updated 2025-02-19 · CVE-2024-3220

Positive Technologies (AI Summary)

CVSS v4.0

2.3

Low

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions CPython versions up to 3.13.x

Description The issue arises from the CPython standard library module "mimetypes" using default locations from Linux and macOS platforms on Windows, where these locations are user-writable. This allows other users to create invalid files, potentially causing a MemoryError when the Python runtime starts or leading to incorrect file type interpretations.

Recommendations To work around this issue, call mimetypes.init() with an empty list ([]) on Windows platforms to avoid using the default list of known file locations.

Fix

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

BIT-PYTHON-2024-3220

BIT-PYTHON-MIN-2024-3220

CVE-2024-3220

ECHO-6E9C-8674-8943

PSF-2025-2

Affected Products

Cpython

References · 15

• https://osv.dev/vulnerability/UBUNTU-CVE-2024-3220 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-3220 · Vendor Advisory
• https://mail.python.org/archives/list/[e-mail]/thread/CDXW34ND2LSAOYAR5N6UNONP4ZBX4D6R · Vendor Advisory
• https://osv.dev/vulnerability/PSF-2025-2 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-python-2024-3220 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-python-min-2024-3220 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-3220 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-3220 · Security Note
• https://security.netapp.com/advisory/ntap-20250314-0001 · Note
• https://twitter.com/WolfgangSesin/status/1890457418322092341 · Twitter Post
• https://twitter.com/oss_security/status/1890588560769618206 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1890568929250017402 · Twitter Post
• https://twitter.com/CVEnew/status/1890439798076088791 · Twitter Post
• http://openwall.com/lists/oss-security/2025/02/14/8 · Note
• https://t.me/cvedetector/18133 · Telegram Post