Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

bug #102387

Closed
zhangxueping-zxp opened this issue Mar 3, 2023 · 6 comments
Closed

bug #102387

zhangxueping-zxp opened this issue Mar 3, 2023 · 6 comments
Labels
type-bug An unexpected behavior, bug, or error

Comments

@zhangxueping-zxp
Copy link

Bug report

Python command injection vulnerability (CVE-2015-2007)

Python version 3.10.4 and earlier has a security vulnerability, which is due to the mailcap module not adding escape characters to the commands found in the system mailcap file

Your environment

Python 3.7.9

  • CPython versions tested on:
  • Operating system and architecture:
    windows and linux
@zhangxueping-zxp zhangxueping-zxp added the type-bug An unexpected behavior, bug, or error label Mar 3, 2023
@JelleZijlstra
Copy link
Member

Your CVE link is wrong but I think this is a duplicate of #68966.

@JelleZijlstra JelleZijlstra closed this as not planned Won't fix, can't repro, duplicate, stale Mar 3, 2023
@zhangxueping-zxp
Copy link
Author

This is the result of vulnerability scanning. Do you have any fixes for the old version

@JelleZijlstra
Copy link
Member

#93543 fixed it for 3.10

@zhangxueping-zxp
Copy link
Author

Hello, I know that 3.10 has been fixed, but I don't update the version. I still use python 3.7.9. Is there any way

@ericvsmith
Copy link
Member

It was backported to 3.7 in #98191. That was in October 2022, and 3.7's last binary installer release was 3.7.9, released on 2020-08-17. You can either build a newer version from source yourself, or get a binary release from a third party.

@JelleZijlstra
Copy link
Member

Or upgrade to a newer version, which is a good idea anyway as 3.7 will stop receiving security fixes in a few months.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
type-bug An unexpected behavior, bug, or error
Projects
None yet
Development

No branches or pull requests

3 participants