AZL-9417
Dashboard / Vulnerabilities / AZL-9417
Summary: CVE-2015-20107 affecting package python3 for versions less than 3.9.13-5
Details: In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9
References: https://nvd.nist.gov/vuln/detail/CVE-2015-20107
Affected packages
Package
Name: python3
Purl: pkg:rpm/azure-linux/python3
Affected ranges
Type: ECOSYSTEM
Events:
Introduced- 0
Fixed -3.9.13-5
Affected versions
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
