CVE-2008-5983

 

Published at: - 28-01-2009 03:30

Last modified: - 05-07-2022 08:57

Total changes: - 2

Description

Untrusted search path vulnerability in the PySys_SetArgv API function in Python 2.6 and earlier, and possibly later versions, prepends an empty string to sys.path when the argv[0] argument does not contain a path separator, which might allow local users to execute arbitrary code via a Trojan horse Python file in the current working directory.

Common Vulnerability Scoring System (CVSS)

AV:L/AC:M/Au:N/C:C/I:C/A:C

 

Verification logic

 

Reference

• [oss-security] 20090126 CVE request -- Python < 2.6 PySys_SetArgv issues (epiphany, csound, dia, eog, gedit, xchat, vim, nautilus-python, Gnumeric)-Mailing List, Third Party Advisory
• [debian-bugs] 20081112 Bug#493937: [Patch] Prevent loading of Python modules in working directory-Patch, Third Party Advisory
• [debian-bugs-rc] 20080805 Bug#484305: bicyclerepair: bike.vim imports untrusted python files from cwd-Broken Link
• [oss-security] 20090128 Re: CVE request -- Python < 2.6 PySys_SetArgv issues (epiphany, csound, dia, eog, gedit, xchat, vim, nautilus-python, Gnumeric)-Mailing List, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=482814
• [oss-security] 20090130 Re: CVE request -- Python < 2.6 PySys_SetArgv issues (epiphany, csound, dia, eog, gedit, xchat, vim, nautilus-python, Gnumeric)-Mailing List, Third Party Advisory
• GLSA-200903-41-Third Party Advisory
• 34522-Not Applicable
• GLSA-200904-06-Third Party Advisory
• FEDORA-2010-9652-Mailing List, Third Party Advisory
• ADV-2010-1448-Permissions Required
• 40194-Not Applicable
• RHSA-2011:0027-Third Party Advisory
• 42888-Not Applicable
• ADV-2011-0122-Permissions Required
• USN-1596-1-Third Party Advisory
• USN-1613-2-Third Party Advisory
• USN-1613-1-Third Party Advisory
• 51040-Not Applicable
• 50858-Not Applicable
• USN-1616-1-Third Party Advisory
• 51087-Not Applicable
• 51024-Not Applicable

 

Keywords

NVD

 

CVE-2008-5983

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures