8

CVE-2015-20107

Exploit

In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9

Data is provided by the National Vulnerability Database (NVD)
Python ≫ Python Version >= 3.7.0 <= 3.7.15
Python ≫ Python Version >= 3.8.0 <= 3.8.15
Python ≫ Python Version >= 3.9.0 <= 3.9.15
Python ≫ Python Version >= 3.10.0 < 3.10.8
Netapp ≫ Active Iq Unified Manager Version- SwPlatformvmware_vsphere
Netapp ≫ Active Iq Unified Manager Version- SwPlatformwindows
Netapp ≫ Snapcenter Version-
Fedoraproject ≫ Fedora Version35
Fedoraproject ≫ Fedora Version36
Fedoraproject ≫ Fedora Version37
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.87% 0.746
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.6 2.8 4.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
nvd@nist.gov 8 8 8.5
AV:N/AC:L/Au:S/C:P/I:C/A:P
CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

https://bugs.python.org/issue24778
Vendor Advisory
Exploit
Issue Tracking
https://github.com/python/cpython/issues/68966
Third Party Advisory
Issue Tracking