In Python 3.8.4, sys.path restrictions specified in a... · CVE-2020-15801 · GitHub Advisory Database · GitHub

In Python 3.8.4, sys.path restrictions specified in a...

High severity Unreviewed Published May 24, 2022 to the GitHub Advisory Database • Updated Jan 29, 2023

Package

No package listed— Suggest a package

Affected versions

Unknown

Patched versions

Unknown

Description

In Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations. The ._pth file (e.g., the python._pth file) is not affected.

References

Published by the National Vulnerability Database

Jul 17, 2020

Published to the GitHub Advisory Database May 24, 2022

Last updated Jan 29, 2023

Weaknesses

CWE-426

Untrusted Search Path

The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control. Learn more on MITRE.

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. Learn more on MITRE.