In Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a Trojan horse python3.dll might be used in cases where CPython is embedded in a native application. This occurs because python3X.dll may use an invalid search path for python3.dll loading (after Py_SetPath has been used). NOTE: this issue CANNOT occur when using python.exe from a standard (non-embedded) Python installation on Windows.
En Python versiones 3.6 hasta 3.6.10, 3.7 hasta 3.7.8, 3.8 hasta 3.8.4rc1 y 3.9 hasta 3.9.0b4 en Windows, se puede usar una python3.dll de tipo caballo de Troya en los casos en que CPython está incorporado en una aplicación nativa. Esto se produce porque python3X.dll puede usar una ruta de búsqueda no válida para cargar python3.dll (después de que haya sido usado Py_SetPath). NOTA: este problema NO PUEDE ocurrir cuando se usa python.exe desde una instalación estándar (no incorporada) de Python en Windows
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | REQUIRED |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
AV:L/AC:M/Au:N/C:C/I:C/A:C
| Access Vector | LOCAL |
|---|---|
| Access Complexity | MEDIUM |
| Authentication | NONE |
| Confidentiality Impact | COMPLETE |
| Integrity Impact | COMPLETE |
| Availability Impact | COMPLETE |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-427
en
CWE-908
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| python | python | * | <built-in method update of dict object at 0x7fd39c402640> | Application |
| python | python | * | <built-in method update of dict object at 0x7fd289cec8c0> | Application |
| python | python | * | <built-in method update of dict object at 0x7fd39c403180> | Application |
| python | python | * | <built-in method update of dict object at 0x7fd3401eb880> | Application |
| python | python | 3.8.4 | <built-in method update of dict object at 0x7fd39c403e40> | Application |
| python | python | 3.9.0 | <built-in method update of dict object at 0x7fd39c402cc0> | Application |
| python | python | 3.9.0 | <built-in method update of dict object at 0x7fd289cee640> | Application |
| python | python | 3.9.0 | <built-in method update of dict object at 0x7fd369c0c380> | Application |
| python | python | 3.9.0 | <built-in method update of dict object at 0x7fd360289240> | Application |
| python | python | 3.9.0 | <built-in method update of dict object at 0x7fd39c402ac0> | Application |
| python | python | 3.9.0 | <built-in method update of dict object at 0x7fd289cee140> | Application |
| python | python | 3.9.0 | <built-in method update of dict object at 0x7fd38423b540> | Application |
| python | python | 3.9.0 | <built-in method update of dict object at 0x7fd38674c980> | Application |
| python | python | 3.9.0 | <built-in method update of dict object at 0x7fd369c0d340> | Application |
| python | python | 3.9.0 | <built-in method update of dict object at 0x7fd37034a640> | Application |
| netapp | snapcenter | - | <built-in method update of dict object at 0x7fd289cede80> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:python:python:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:python:python:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:python:python:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:python:python:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:python:python:3.8.4:rc1:*:*:*:*:*:* |
| Yes | cpe:2.3:a:python:python:3.9.0:alpha1:*:*:*:*:*:* |
| Yes | cpe:2.3:a:python:python:3.9.0:alpha2:*:*:*:*:*:* |
| Yes | cpe:2.3:a:python:python:3.9.0:alpha3:*:*:*:*:*:* |
| Yes | cpe:2.3:a:python:python:3.9.0:alpha4:*:*:*:*:*:* |
| Yes | cpe:2.3:a:python:python:3.9.0:alpha5:*:*:*:*:*:* |
| Yes | cpe:2.3:a:python:python:3.9.0:alpha6:*:*:*:*:*:* |
| Yes | cpe:2.3:a:python:python:3.9.0:beta1:*:*:*:*:*:* |
| Yes | cpe:2.3:a:python:python:3.9.0:beta2:*:*:*:*:*:* |
| Yes | cpe:2.3:a:python:python:3.9.0:beta3:*:*:*:*:*:* |
| Yes | cpe:2.3:a:python:python:3.9.0:beta4:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* |