vulnwire
6.9med

CVE-2008-5983

Untrusted search path vulnerability in the PySys_SetArgv API function in Python 2.6 and earlier, and possibly later versions, prepends an e…

Published 17 y ago · modified 4 mo ago · JSON

CVSS
6.9
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.5%
percentile 42%
Public exploits
0
none known

Untrusted search path vulnerability in the PySys_SetArgv API function in Python 2.6 and earlier, and possibly later versions, prepends an empty string to sys.path when the argv[0] argument does not contain a path separator, which might allow local users to execute arbitrary code via a Trojan horse Python file in the current working directory.

Exploit prediction (EPSS)

0.49% probability of exploitation in the next 30 days, higher than 42% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.06.9AV:L/AC:M/Au:N/C:C/I:C/A:C

Classification

Weakness

References

  • mail-archive.com /debian-bugs-dist%40lists.debian.org/msg586010.html · mailing-list, x_refsource_MLIST, x_transferred
  • bugzilla.redhat.com /show_bug.cgi?id=482814 · x_refsource_MISC, x_transferred
  • lists.fedoraproject.org /pipermail/package-announce/2010-June/042751.html · vendor-advisory, x_refsource_FEDORA, x_transferred
  • secunia.com /advisories/51087 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • openwall.com /lists/oss-security/2009/01/30/2 · mailing-list, x_refsource_MLIST, x_transferred
  • ubuntu.com /usn/USN-1616-1 · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • secunia.com /advisories/51040 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • security.gentoo.org /glsa/glsa-200903-41.xml · vendor-advisory, x_refsource_GENTOO, x_transferred
  • openwall.com /lists/oss-security/2009/01/26/2 · mailing-list, x_refsource_MLIST, x_transferred
  • vupen.com /english/advisories/2010/1448 · vdb-entry, x_refsource_VUPEN, x_transferred
  • secunia.com /advisories/50858 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • nabble.com /Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td1884809 · mailing-list, x_refsource_MLIST, x_transferred
  • security.gentoo.org /glsa/glsa-200904-06.xml · vendor-advisory, x_refsource_GENTOO, x_transferred
  • vupen.com /english/advisories/2011/0122 · vdb-entry, x_refsource_VUPEN, x_transferred
  • openwall.com /lists/oss-security/2009/01/28/5 · mailing-list, x_refsource_MLIST, x_transferred
  • secunia.com /advisories/34522 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/42888 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • ubuntu.com /usn/USN-1596-1 · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • secunia.com /advisories/40194 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • redhat.com /support/errata/RHSA-2011-0027.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • ubuntu.com /usn/USN-1613-2 · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • secunia.com /advisories/51024 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • ubuntu.com /usn/USN-1613-1 · vendor-advisory, x_refsource_UBUNTU, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.