CVE-2020-8315 Other in n/a
An attacker can execute arbitrary code by placing a malicious DLL in the application directory on Windows 7 systems running Python.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-8315?
CVE-2020-8315 is a medium-severity vulnerability in Python Python, published on 28 Jan 2020. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
In Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an insecure dependency load upon launch on Windows 7 may result in an attacker's copy of api-ms-win-core-path-l1-1-0.dll being loaded and used instead of the system's copy. Windows 8 and later are unaffected.
Weakness: CWE-427
Which versions are affected by CVE-2020-8315?
3 open source packages ship an affected version, including libpython, python and python-min. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
libpython Bitnami | From 3.6.0 | 3.6.11, 3.7.7, 3.8.2 |
python Bitnami | From 3.6.0 | 3.6.11, 3.7.7, 3.8.2 |
python-min Bitnami | From 3.6.0 | 3.6.11, 3.7.7, 3.8.2 |
Products include Python Python.
How do I fix CVE-2020-8315?
Upgrade libpython to a fixed version for your release line: 3.6.11, 3.7.7 or 3.8.2.
Is CVE-2020-8315 being exploited?
There is no known exploitation of CVE-2020-8315 in the wild and no public exploit code.
Other vulnerabilities in Python Python
Sources
Also known as ALPINE-CVE-2020-8315, BIT-libpython-2020-8315, BIT-python-2020-8315, BIT-python-min-2020-8315, CLEANSTART-2026-LG19645, GHSA-646c-5wg7-pw2g and 1 more.