CVEvulnerability

CVE-2015-20107

7.6 HIGH Published 2022-04-13 Modified 2026-10-14 Official page ↗
Status
Modified
Published
2022-04-13
Last modified
2026-10-14
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.6 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
8.0 HIGH — AV:N/AC:L/Au:S/C:P/I:C/A:P
Weaknesses
CWE-77

Description

In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9

Affected configurations

• python python (>= 3.7.0 <= 3.7.15) • python python (>= 3.8.0 <= 3.8.15) • python python (>= 3.9.0 <= 3.9.15) • python python (>= 3.10.0 < 3.10.8) • netapp active iq unified manager • netapp ontap select deploy administration utility • netapp snapcenter • fedoraproject fedora 35 • fedoraproject fedora 36 • fedoraproject fedora 37

Related

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References