CVE-2023-41105
An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.normpath(), the path will be truncated une...
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.normpath(), the path will be truncated unexpectedly at the first '\0' byte. There are plausible cases in which an application would have rejected a filename for security reasons in Python 3.10.x or earlier, but that filename is no longer rejected in Python 3.11.x.
影響パッケージ
Bitnami
python-min
[{"type":"SEMVER","events":[{"introduced":"3.11.0"},{"fixed":"3.11.5"}]}]
Bitnami
libpython
[{"type":"SEMVER","events":[{"introduced":"3.11.0"},{"fixed":"3.11.5"}]}]
Bitnami
python
[{"type":"SEMVER","events":[{"introduced":"3.11.0"},{"fixed":"3.11.5"}]}]
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2023-41105 python3.11 修正版: 3.11.2-6+deb12u2
参照URL
- advisory security.netapp.com
- advisory nvd.nist.gov
- advisory github.com
- patch github.com
- patch github.com
- patch github.com
- report github.com
- web mail.python.org