Lib/webbrowser.py in Python through 3.6.3 does not validate strings before launching the program specified by the BROWSER environment variable which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a software maintainer indicates that exploitation is impossible because the code relies on subprocess.Popen and the default shell=False setting

🗓️ 18 Aug 2020 07:00:00Reported by MicrosoftType

Python webbrowser up to 3.6.3 may allow argument injection via unvalidated BROWSER setting.

Reporter	Title	Published	Views	Family All 21
CBLMariner	CVE-2017-17522 affecting package python2 2.7.18-14	8 Oct 202018:09	–	cbl_mariner
CBLMariner	CVE-2017-17522 affecting package python2 for versions less than 2.7.18-8	9 Apr 202206:51	–	cbl_mariner
CNVD	Python 'Lib/webbrowser.py' Remote Command Execution Vulnerability	15 Dec 201700:00	–	cnvd
CVE	CVE-2017-17522	14 Dec 201716:00	–	cve
Cvelist	CVE-2017-17522	14 Dec 201716:00	–	cvelist
Debian CVE	CVE-2017-17522	14 Dec 201716:00	–	debiancve
F5 Networks	K53955014: Python vulnerabilities CVE-2016-1494, CVE-2016-6536, CVE-2017-17522, CVE-2017-18207, and CVE-2018-1000030	21 Feb 202318:35	–	f5
NCSC	Vulnerabilities fixed in Juniper Junos Space	19 Apr 202100:00	–	ncsc
NCSC	Vulnerabilities fixed in Microsoft Mariner	13 Aug 202418:23	–	ncsc
NVD	CVE-2017-17522	14 Dec 201716:29	–	nvd