Yüksek CVSS 7.6 PoC var

CVE-2015-20107: Python: komut enjeksiyonu

Yayın: 13 Nisan 2022 19:15 · Güncelleme: 6 Kasım 2026 09:48

Açıklama (NVD)

In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9

Özet bilgiler

Ürün: Python Python
CVSS v3.1: 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
EPSS: %2,78 (yüzdelik 86)
CWE: CWE-77
Yama: Mevcut

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
python-python	3.7.0	3.7.15	—
python-python	3.8.0	3.8.15	—
python-python	3.9.0	3.9.15	—
python-python	3.10.0	—	3.10.8
netapp-active-iq-unified-manager	—	—	—
netapp-active-iq-unified-manager	—	—	—
netapp-ontap-select-deploy-administration-utility	—	—	—
netapp-snapcenter	—	—	—
fedoraproject-fedora	35	35	—
fedoraproject-fedora	36	36	—
fedoraproject-fedora	37	37	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları