The vulnerability of the python38._pth file of the Python interpreter lies in its ability to ignore the restrictions specified in the python38._pth file within sys.path. This allows a malicious actor to execute arbitrary code.

🗓️ 08 Nov 2024 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 4 Views

Python interpreter python38._pth file ignores path restrictions, enabling remote code execution.

Reporter	Title	Published	Views	Family All 65
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Cloud Pak for Data - Python (CVE-2020-15801)	14 May 202118:45	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Python affects IBM Spectrum Protect Plus Microsoft Windows File Systems agent (CVE-2020-15801)	20 Nov 202020:13	–	ibm
FreeBSD	Python -- multiple vulnerabilities	11 Feb 202000:00	–	freebsd
CNVD	Python has an unspecified vulnerability	29 Jul 202000:00	–	cnvd
CVE	CVE-2020-15801	17 Jul 202002:15	–	cve
Cvelist	CVE-2020-15801	17 Jul 202002:15	–	cvelist
Debian CVE	CVE-2020-15801	17 Jul 202002:15	–	debiancve
EUVD	EUVD-2020-7784	7 Oct 202500:30	–	euvd
Tenable Nessus	FreeBSD : Python -- multiple vulnerabilities (7d7221ee-d334-11ea-bc50-080027846a02)	3 Aug 202000:00	–	nessus
Tenable Nessus	Siemens SIMATIC S7-1500 Untrusted Search Path (CVE-2020-15801)	13 Nov 202500:00	–	nessus

Vulners

Node

python pythonRange3.7.0–3.7.9

OR

python pythonRange3.8.0–3.8.5

Source	Link
bugs	www.bugs.python.org/issue41304
redos	www.redos.red-soft.ru/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-python3-cve-2019-20907-cve-2020-15801/
github	www.github.com/python/cpython/issues/85476
web	www.web.nvd.nist.gov/view/vuln/detail

08 Nov 2024 00:00Current

7.3High risk

Vulners AI Score7.3

CVSS 39.8

CVSS 210

EPSS0.03104

python thirty eight path restrictions remote execution arbitrary code