PSF-2022-2

    Dashboard / Vulnerabilities / PSF-2022-2

    PSF-2022-2

    Published: 3 Oct 2022Last Modified: 9 Oct 2025

    Summary: Buffer overflow vulnerability in os.symlink on Windows

    Details: Python Software Foundation CPython version From 3.2 until 3.6.4 on Windows contains a Buffer Overflow vulnerability in os.symlink() function on Windows that can result in Arbitrary code execution, likely escalation of privilege. This attack appears to be exploitable via a python script that creates a symlink with an attacker controlled name or location. This vulnerability appears to have been fixed in 3.7.0 and 3.6.5.

    References: https://mail.python.org/mm3/archives/list/[email protected]/thread/PVSURQ2YCNZODILA3QE7ZF3GCD25EVVT/, https://bugs.python.org/issue33001

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -6921e73e33edc3c61bc2d78ed558eaa22a89a564

    Affected versions

    2.5

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High