NVD Vulnerability Detail

CVE-2020-15523

Summary	In Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a Trojan horse python3.dll might be used in cases where CPython is embedded in a native application. This occurs because python3X.dll may use an invalid search path for python3.dll loading (after Py_SetPath has been used). NOTE: this issue CANNOT occur when using python.exe from a standard (non-embedded) Python installation on Windows.
Publication Date	July 5, 2020, 8:15 a.m.
Registration Date	Jan. 26, 2021, 11:53 a.m.
Last Update	Nov. 21, 2024, 2:05 p.m.

Affected software configurations

Configuration2		or higher	or less	more than	less than
cpe:2.3:a:netapp:snapcenter:-:::::::*

Related information, measures and tools

No	URL	タグ
1	https://bugs.python.org/issue29778	Issue Tracking Patch Vendor Advisory
2	https://bugs.python.org/issue29778	Issue Tracking Patch Vendor Advisory
3	https://github.com/python/cpython/pull/21297	Patch Third Party Advisory
4	https://github.com/python/cpython/pull/21297	Patch Third Party Advisory
5	https://security.netapp.com/advisory/ntap-20210312-0004/	Issue Tracking Patch Third Party Advisory
6	https://security.netapp.com/advisory/ntap-20210312-0004/	Issue Tracking Patch Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-427	制御されていない検索パスの要素	https://cwe.mitre.org/data/definitions/427.html
2	CWE-908	初期化されていないリソースの使用	https://cwe.mitre.org/data/definitions/908.html

JVN Vulnerability Information

Python における制御されていない検索パスの要素に関する脆弱性

Title	Python における制御されていない検索パスの要素に関する脆弱性
Summary	Python には、制御されていない検索パスの要素に関する脆弱性が存在します。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	July 6, 2020, midnight
Registration Date	Aug. 21, 2020, 3:20 p.m.
Last Update	Aug. 21, 2020, 3:20 p.m.

Affected System

Python Software Foundation

Python 3.6 から 3.6.10,

Python 3.7 から 3.7.8

Python 3.8 から 3.8.4rc1

Python 3.9 から 3.9.0b4

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2020-15523	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15523
National Vulnerability Database (NVD)
2	CVE-2020-15523	https://nvd.nist.gov/vuln/detail/CVE-2020-15523

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-427	https://cwe.mitre.org/data/definitions/427.html

ベンダー情報

No	Name	URL
GitHub
1	bpo-29778: Ensure python3.dll is loaded from correct locations when Python is embedded #21297	https://github.com/python/cpython/pull/21297
Python bug tracker
2	[CVE-2020-15523] _Py_CheckPython3 uses uninitialized dllpath when embedder sets module path with Py_SetPath	https://bugs.python.org/issue29778

Change Log

No	Changed Details	Date of change
1	[2020年08月21日] 掲載	Aug. 21, 2020, 3:20 p.m.