7.8

CVE-2020-15523

In Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a Trojan horse python3.dll might be used in cases where CPython is embedded in a native application. This occurs because python3X.dll may use an invalid search path for python3.dll loading (after Py_SetPath has been used). NOTE: this issue CANNOT occur when using python.exe from a standard (non-embedded) Python installation on Windows.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Python ≫ Python Version >= 3.5.0 < 3.5.10
   Microsoft ≫ Windows Version -
Python ≫ Python Version >= 3.6.0 < 3.6.12
   Microsoft ≫ Windows Version -
Python ≫ Python Version >= 3.7.0 < 3.7.9
   Microsoft ≫ Windows Version -
Python ≫ Python Version >= 3.8.0 < 3.8.4
   Microsoft ≫ Windows Version -
Python ≫ Python Version 3.8.4 Update rc1
   Microsoft ≫ Windows Version -
Python ≫ Python Version 3.9.0 Update alpha1
   Microsoft ≫ Windows Version -
Python ≫ Python Version 3.9.0 Update alpha2
   Microsoft ≫ Windows Version -
Python ≫ Python Version 3.9.0 Update alpha3
   Microsoft ≫ Windows Version -
Python ≫ Python Version 3.9.0 Update alpha4
   Microsoft ≫ Windows Version -
Python ≫ Python Version 3.9.0 Update alpha5
   Microsoft ≫ Windows Version -
Python ≫ Python Version 3.9.0 Update alpha6
   Microsoft ≫ Windows Version -
Python ≫ Python Version 3.9.0 Update beta1
   Microsoft ≫ Windows Version -
Python ≫ Python Version 3.9.0 Update beta2
   Microsoft ≫ Windows Version -
Python ≫ Python Version 3.9.0 Update beta3
   Microsoft ≫ Windows Version -
Python ≫ Python Version 3.9.0 Update beta4
   Microsoft ≫ Windows Version -
Netapp ≫ Snapcenter Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.9% 0.548
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NIST 6.9 3.4 10
AV:L/AC:M/Au:N/C:C/I:C/A:C
CWE-427 Uncontrolled Search Path Element

The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

CWE-908 Use of Uninitialized Resource

The product uses or accesses a resource that has not been initialized.

https://bugs.python.org/issue29778
Patch
Vendor Advisory
Issue Tracking
https://github.com/python/cpython/pull/21297
Patch
Third Party Advisory
https://security.netapp.com/advisory/ntap-20210312-0004/
Patch
Third Party Advisory
Issue Tracking