Skip to content

[CVE-2020-15801] python 38 embed ignore python38._pth file on windows #85476

Closed
Closed
[CVE-2020-15801] python 38 embed ignore python38._pth file on windows#85476
Labels
3.10 (EOL)end of life3.7 (EOL)end of life3.8 (EOL)end of life3.9 (EOL)end of lifeOS-windowsinterpreter-core(Objects, Python, Grammar, and Parser dirs)type-securityA security issue

Description

@jgiardet
jgiardet
mannequin
opened on Jul 15, 2020
BPO 41304
Nosy @pfmoore, @tjguk, @ned-deily, @zware, @zooba, @miss-islington, @jgiardet
PRs
  • bpo-41304: Ensure python3x._pth is loaded on Windows #21495
  • [3.9] bpo-41304: Ensure python3x._pth is loaded on Windows (GH-21495) #21497
  • [3.8] bpo-41304: Ensure python3x._pth is loaded on Windows (GH-21495) #21498
  • [3.7] bpo-41304: Ensure python3x._pth is loaded on Windows (GH-21495) #21499
  • bpo-41304: Update NEWS to include CVE-2020-15801 reference #21521
  • [3.9] bpo-41304: Update NEWS to include CVE-2020-15801 reference (GH-21521) #21522
  • [3.7] bpo-41304: Update NEWS to include CVE-2020-15801 reference (GH-21521) #21524
  • [3.8] bpo-41304: Update NEWS to include CVE-2020-15801 reference (GH-21521) #21523
    		•

    Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = None
closed_at = <Date 2020-07-16.17:08:16.246>
created_at = <Date 2020-07-15.14:41:17.913>
labels = ['type-security', 'interpreter-core', '3.8', '3.9', '3.10', '3.7', 'OS-windows']
title = '[CVE-2020-15801] python 38 embed ignore python38._pth file on windows'
updated_at = <Date 2020-08-06.16:10:28.228>
user = 'https://github.com/jgiardet'

    bugs.python.org fields:

    activity = <Date 2020-08-06.16:10:28.228>
actor = 'steve.dower'
assignee = 'none'
closed = True
closed_date = <Date 2020-07-16.17:08:16.246>
closer = 'steve.dower'
components = ['Interpreter Core', 'Windows']
creation = <Date 2020-07-15.14:41:17.913>
creator = 'jgirardet'
dependencies = []
files = []
hgrepos = []
issue_num = 41304
keywords = ['patch', '3.8regression']
message_count = 14.0
messages = ['373698', '373701', '373706', '373727', '373728', '373729', '373731', '373756', '373836', '373837', '373838', '373891', '374912', '374942']
nosy_count = 8.0
nosy_names = ['paul.moore', 'tim.golden', 'ned.deily', 'zach.ware', 'steve.dower', 'miss-islington', 'jgirardet', 'owen.huang']
pr_nums = ['21495', '21497', '21498', '21499', '21521', '21522', '21524', '21523']
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue41304'
versions = ['Python 3.7', 'Python 3.8', 'Python 3.9', 'Python 3.10']

    Activity

    1. jgiardet commented on Jul 15, 2020

      @jgiardet
      jgiardetmannequin
      on Jul 15, 2020
      MannequinAuthor

      Hi,
      With python embed unziped in 38 directory(python 3.8.4):

      # python38._pth
python38.zip
.
..\\app
# Uncomment to run site.main() automatically
#import site

      PS C:\Users\jimmy\rien\embed> .\38\python.exe -c "import sys;print(sys.path);import hello"
['', 'C:\\Users\\jimmy\\rien\\embed\\38\\python38.zip', 'C:\\Users\\jimmy\\rien\\embed\\38\\DLLs', 'C:\\Users\\jimmy\\ri
en\\embed\\38\\lib', 'C:\\Users\\jimmy\\rien\\embed\\38']
Traceback (most recent call last):
  File "<string>", line 1, in <module>
ModuleNotFoundError: No module named 'hello'


'\\app' is not added to sys.path. it is under python 3.

      Note It's working under python 3.7.8

    2. jgiardet
      added
      3.8 (EOL)end of life
      interpreter-core(Objects, Python, Grammar, and Parser dirs)
      on Jul 15, 2020
    3. jgiardet
      changed the title [-]python 38 embed ignore python38._pth file[/-] [+]python 38 embed ignore python38._pth file on windows[/+] on Jul 15, 2020

    4. jgiardet commented on Jul 15, 2020

      @jgiardet
      jgiardetmannequin
      on Jul 15, 2020
      MannequinAuthor

      replacing python38._pth by python._pth does fix it.

    5. tirkarthi
      added
      OS-windows
      on Jul 15, 2020

    6. zooba commented on Jul 15, 2020

      @zooba
      zooba
      on Jul 15, 2020
      Member

      Thanks, this is a regression.

      https://github.com/python/cpython/blob/master/PC/getpathp.c#L672 should be inverted, as a zero return value indicates success.

    7. zooba
      added
      3.7 (EOL)end of life
      3.9 (EOL)end of life
      3.10 (EOL)end of life
      type-securityA security issue
      on Jul 15, 2020

    8. zooba commented on Jul 15, 2020

      @zooba
      zooba
      on Jul 15, 2020
      Member

      New changeset 936a660 by Steve Dower in branch 'master':
      bpo-41304: Ensure python3x._pth is loaded on Windows (GH-21495)
      936a660

    9. miss-islington commented on Jul 15, 2020

      @miss-islington
      miss-islington
      on Jul 15, 2020
      Contributor

      New changeset 28e93dd by Miss Islington (bot) in branch '3.9':
      bpo-41304: Ensure python3x._pth is loaded on Windows (GH-21495)
      28e93dd

    10. miss-islington commented on Jul 15, 2020

      @miss-islington
      miss-islington
      on Jul 15, 2020
      Contributor

      New changeset 3b6a8d2 by Miss Islington (bot) in branch '3.8':
      bpo-41304: Ensure python3x._pth is loaded on Windows (GH-21495)
      3b6a8d2

    11. ned-deily commented on Jul 15, 2020

      @ned-deily
      ned-deily
      on Jul 15, 2020
      Member

      New changeset 4bfcffe by Steve Dower in branch '3.7':
      bpo-41304: Ensure python3x._pth is loaded on Windows (GH-21495) (bpo-21499)
      4bfcffe

    12. zooba commented on Jul 16, 2020

      @zooba
      zooba
      on Jul 16, 2020
      Member

      For clarity, this was caused by the fix for bpo-29778, and was only released in 3.8.4 and 3.9.0b4. No other versions had a release before the fix was merged.

    13. zooba
      closed this as completedon Jul 16, 2020

    14. zooba commented on Jul 17, 2020

      @zooba
      zooba
      on Jul 17, 2020
      Member

      This is now assigned CVE-2020-15801

    15. zooba
      changed the title [-]python 38 embed ignore python38._pth file on windows[/-] [+][CVE-2020-15801] python 38 embed ignore python38._pth file on windows[/+] on Jul 17, 2020

    16. zooba commented on Jul 17, 2020

      @zooba
      zooba
      on Jul 17, 2020
      Member

      New changeset a16ac4e by Miss Islington (bot) in branch '3.9':
      bpo-41304: Update NEWS to include CVE-2020-15801 reference (GH-21521)
      a16ac4e

    17. zooba commented on Jul 17, 2020

      @zooba
      zooba
      on Jul 17, 2020
      Member

      New changeset 79ed1a5 by Miss Islington (bot) in branch '3.8':
      bpo-41304: Update NEWS to include CVE-2020-15801 reference (GH-21521)
      79ed1a5

    18. ned-deily commented on Jul 18, 2020

      @ned-deily
      ned-deily
      on Jul 18, 2020
      Member

      New changeset eb0d255 by Miss Islington (bot) in branch '3.7':
      bpo-41304: Update NEWS to include CVE-2020-15801 reference (GH-21521) (GH-21524)
      eb0d255

    19. owenhuang commented on Aug 6, 2020

      @owenhuang
      owenhuangmannequin
      on Aug 6, 2020
      Mannequin

      hi, since the affected system is not clearly stated on the NVD, I'd like to confirm with you that:

      Does the CVE-2020-15801 vulnerability affect only the Windows OS?

      thanks a lot!

    20. zooba commented on Aug 6, 2020

      @zooba
      zooba
      on Aug 6, 2020
      Member

      Yes, it only affects Windows OS.

      On all other platforms, the python38._pth file is _always_ ignored. We have not implemented this support for those platforms.

    21. ezio-melotti
      transferred this issue fromon Apr 10, 2022
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

    Metadata

    Metadata

    Assignees

    No one assigned

      Labels

      3.10 (EOL)end of life3.7 (EOL)end of life3.8 (EOL)end of life3.9 (EOL)end of lifeOS-windowsinterpreter-core(Objects, Python, Grammar, and Parser dirs)type-securityA security issue

      Projects

      No projects

        Milestone

        No milestone

        Relationships

        None yet

        Development

        No branches or pull requests

        Issue actions