CVE-2020-15523 is an invalid search path in Python 3.6 and later on Windows. It occurs during Py_Initialize() when the runtime attempts to pre-load python3.dll. If Py_SetPath() has been called, the expected location is not set, and locations elsewhere on the user's system will be searched.

This issue is not triggered when running python.exe. It only applies when CPython has been embedded in another application.

Issue: https://bugs.python.org/issue29778 Patch: https://github.com/python/cpython/pull/21297

The next patched releases will be: 3.9.0b5, 3.8.4, 3.7.9 (source only), 3.6.12 (source only)

Other than applying the patch, applications may mitigate the vulnerability by explicitly calling LoadLibrary() on their copy of python3.dll before calling Py_Initialize(). Even with the patch applied, applications should include a copy of python3.dll alongside their main Python DLL.

Thanks to Eric Gantumur for detecting and reporting the issue to the Python Security Response Team.

Questions to security-sig@python.org or security@python.org.

Cheers, Steve Dower Python Security Response Team