CVE-2023-41105
An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.normpath(), the path will be truncated une...
Original description
The description as published by the source.
An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.normpath(), the path will be truncated unexpectedly at the first '\0' byte. There are plausible cases in which an application would have rejected a filename for security reasons in Python 3.10.x or earlier, but that filename is no longer rejected in Python 3.11.x.
Affected packages
Bitnami
python-min
[{"type":"SEMVER","events":[{"introduced":"3.11.0"},{"fixed":"3.11.5"}]}]
Bitnami
libpython
[{"type":"SEMVER","events":[{"introduced":"3.11.0"},{"fixed":"3.11.5"}]}]
Bitnami
python
[{"type":"SEMVER","events":[{"introduced":"3.11.0"},{"fixed":"3.11.5"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2023-41105 python3.11 Fixed in: 3.11.2-6+deb12u2
References
- advisory security.netapp.com
- advisory nvd.nist.gov
- advisory github.com
- patch github.com
- patch github.com
- patch github.com
- report github.com
- web mail.python.org