Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2015-20107

In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9

Published

2022-04-13T16:15:08.937

Last Modified

2024-11-21T02:26:33.447

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.6 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:P/I:C/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: SINGLE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: COMPLETE
  • Availability Impact: PARTIAL
Exploitability Score

8.0

Impact Score

8.5

Weaknesses
  • Type: Primary
    CWE-77
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application python python ≤ 3.7.15 Yes
Application python python ≤ 3.8.15 Yes
Application python python ≤ 3.9.15 Yes
Application python python < 3.10.8 Yes
Application netapp active_iq_unified_manager - Yes
Application netapp active_iq_unified_manager - Yes
Application netapp ontap_select_deploy_administration_utility - Yes
Application netapp snapcenter - Yes
Operating System fedoraproject fedora 35 Yes
Operating System fedoraproject fedora 36 Yes
Operating System fedoraproject fedora 37 Yes
References