Skip to content

[CVE-2015-20107] CVE-2015-20107 Vulnerability Is Found in Python #91871

New issue
New issue
Closed
Closed
[CVE-2015-20107] CVE-2015-20107 Vulnerability Is Found in Python#91871
Labels
type-securityA security issue

Description

@dymc1987
dymc1987
opened on Apr 24, 2022

In Python (aka CPython) through 3.10.4, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments).

Activity

  1. sweeneyde commented on Apr 24, 2022

    @sweeneyde
    sweeneyde
    on Apr 24, 2022
    Member

    Duplicate of #68966?

  2. auvipy commented on Apr 24, 2022

    @auvipy
    auvipy
    on Apr 24, 2022

    probably a duplicate & related fix #91542

  3. AlexWaygood
    added
    type-securityA security issue
    on Apr 24, 2022

  4. kalashnlkov commented on Apr 24, 2022

    @kalashnlkov
    kalashnlkov
    on Apr 24, 2022

    Duplicate of #68966?

    this description seems coming from NVD https://nvd.nist.gov/vuln/detail/CVE-2015-20107.
    it‘s duplicate for sure.

  5. ericvsmith commented on Apr 24, 2022

    @ericvsmith
    ericvsmith
    on Apr 24, 2022
    Member

    Closing in favor of #68966.

  6. ericvsmith
    closed this as completedon Apr 24, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    type-securityA security issue

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions