Vulnerability Details CVE-2020-15801
In Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations. The <executable-name>._pth file (e.g., the python._pth file) is not affected.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.036
EPSS Ranking 89.4%
CVSS Severity
CVSS v3 Score 9.8
CVSS v2 Score 7.5
References
- https://bugs.python.org/issue41304
- https://github.com/python/cpython/pull/21495
- https://security.netapp.com/advisory/ntap-20200731-0003/
- https://bugs.python.org/issue41304
- https://github.com/python/cpython/pull/21495
- https://security.netapp.com/advisory/ntap-20200731-0003/
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
Products affected by CVE-2020-15801
-
cpe:2.3:a:netapp:max_data:-
-
cpe:2.3:a:python:python:3.7.0
-
cpe:2.3:a:python:python:3.7.1
-
cpe:2.3:a:python:python:3.7.2
-
cpe:2.3:a:python:python:3.7.3
-
cpe:2.3:a:python:python:3.7.4
-
cpe:2.3:a:python:python:3.7.5
-
cpe:2.3:a:python:python:3.7.6
-
cpe:2.3:a:python:python:3.7.7
-
cpe:2.3:a:python:python:3.7.8