CVE-2020-15801 In Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations.
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2020-15801?
CVE-2020-15801 is a critical vulnerability in Python Python, published on 17 Jul 2020.
Official description
In Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations. The <executable-name>._pth file (e.g., the python._pth file) is not affected.
Weakness: CWE-426
Which versions are affected by CVE-2020-15801?
3 open source packages ship an affected version, including libpython, python and python-min. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
libpython Bitnami | From 3.7.0 | 3.7.9, 3.8.5 |
python Bitnami | From 3.7.0 | 3.7.9, 3.8.5 |
python-min Bitnami | From 3.7.0 | 3.7.9, 3.8.5 |
Products include Netapp Max Data, Python Python.
How do I fix CVE-2020-15801?
Upgrade libpython to a fixed version for your release line: 3.7.9 or 3.8.5.
Is CVE-2020-15801 being exploited?
There is no known exploitation of CVE-2020-15801 in the wild and no public exploit code.
Sources
Also known as BIT-libpython-2020-15801, BIT-python-2020-15801, BIT-python-min-2020-15801, GHSA-45fw-qrx2-rj7m.