Incomplete PE version parsing in python checker on Windows (missing FileVersion from metadata) #5074
Description
Describe the bug
On Windows, the python checker (and potentially others) fails to extract correct FileVersion or ProductVersion from PE files like .dll and .exe, even when these values are present in the version resource of the file.
The fallback super().get_versions() returns UNKNOWN or incorrect version numbers extracted from unrelated strings (e.g. 6.0.0, 1.2.13).
To Reproduce
Steps to reproduce the behavior:
Run cve-bin-tool v3.4 on any recent Windows Python binary (e.g. python310.dll or python.exe from Python 3.10.11).
Use -l debug and observe that:
Log says no ProductVersion/FileVersion found in PE metadata
Version is detected as UNKNOWN
No CVEs are reported
Expected behavior
Proper version should be extracted from PE resource metadata like:
txt
複製
編輯
StringFileInfo > 040904b0 > FileVersion: 3.10.11
and matched against known CVEs.
Proposed fix
Use pefile to properly parse FileInfo structure, like this:
python
複製
編輯
import pefile
pe = pefile.PE(filepath)
for entry in pe.FileInfo:
if entry.Key == b'StringFileInfo':
for st in entry.StringTable:
version = st.entries.get(b'FileVersion') or st.entries.get(b'ProductVersion')
...
or wrap this in a PE-specific helper (e.g. extract_pe_version()).
Environment:
OS: Windows 10/11
Python version: tested with 3.10.11 and 3.13.3
CVE Binary Tool version: 3.4
Additional context
After manually patching the checker to extract PE version via pefile, the tool detects CVEs correctly (e.g., CVE-2023-24329, CVE-2023-27043, etc.).
Suggested workaround (also worth integrating):
python
複製
編輯
VENDOR_PRODUCT = [
("python_software_foundation", "python"),
("python", "python"),
("python", "cpython"),
("cpython", "cpython"),
]