IM
IronMonkey Threat Research

CVE-2015-20107 HIGH

Published: 2022-04-13 | Last Modified: 2026-10-08 | Status: Modified

Description

In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9

Additional Descriptions (1)

En Python (también conocido como CPython) hasta la versión 3.10.8, el módulo mailcap no añade caracteres de escape en los comandos descubiertos en el archivo mailcap del sistema. Esto puede permitir a los atacantes inyectar comandos de shell en aplicaciones que llamen a mailcap.findmatch con entradas no confiables (si carecen de validación de los nombres de archivos o argumentos proporcionados por el usuario). La corrección también se ha aplicado a las versiones 3.7, 3.8 y 3.9

CVSS Metrics

Base Score: 7.6 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredLOW
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactLOW
Integrity ImpactHIGH
Availability ImpactLOW

Source: [email protected]

Type: Primary

Exploitability Score: 2.8

Impact Score: 4.7

Base Score: 8.0 (HIGH)

AV:N/AC:L/Au:S/C:P/I:C/A:P

Access VectorNETWORK
Access ComplexityLOW
AuthenticationSINGLE
Confidentiality ImpactPARTIAL
Integrity ImpactCOMPLETE
Availability ImpactPARTIAL

Source: [email protected]

Type: Primary

Exploitability Score: 8.0

Impact Score: 8.5

Weaknesses

Source Type Description
[email protected] Primary
en CWE-77
134c704f-9b21-4f2e-91b3-4a467353bcc0 Secondary
en CWE-77

Affected Products

Vendor Product Version Update Type
python python * <built-in method update of dict object at 0x7fd36b162f40> Application
python python * <built-in method update of dict object at 0x7fd39c40b500> Application
python python * <built-in method update of dict object at 0x7fd34b8da800> Application
python python * <built-in method update of dict object at 0x7fd368dcf240> Application
netapp active_iq_unified_manager - <built-in method update of dict object at 0x7fd3848e0640> Application
netapp active_iq_unified_manager - <built-in method update of dict object at 0x7fd39c40b100> Application
netapp ontap_select_deploy_administration_utility - <built-in method update of dict object at 0x7fd39c4e5c40> Application
netapp snapcenter - <built-in method update of dict object at 0x7fd385490380> Application
fedoraproject fedora 35 <built-in method update of dict object at 0x7fd39c40ab40> Operating System
fedoraproject fedora 36 <built-in method update of dict object at 0x7fd3848e2fc0> Operating System
fedoraproject fedora 37 <built-in method update of dict object at 0x7fd34b8d9780> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:python:python:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
Yes cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
Yes cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
Yes cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
Yes cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*

References