Security-SIG

Download

security-sig@python.org

May 2022

3 participants
2 discussions

[CVE-2015-20107] Shell injection in mailcap module
by Steve Dower Aug. 25, 2022

Aug. 25, 2022

CVE-2015-20107 has been assigned for an issue previously reported against the mailcap module. The mailcap module reads registered commands on Linux systems to determine how to launch certain file types. The Python module does not add additional escape characters to these commands, which may allow an attacker to provide file paths or parameters that include additional shell commands. These may be executed during mailcap.find_match() depending on the system's configuration. All users of the mailcap module in any version of CPython may be impacted. No patch is currently available, and the module is likely to be deprecated due to lack of an active maintainer. Please visit the issue tracker at the link below to join the discussion if you are able to assist. To mitigate, applications that use this module should verify user input before passing it to the mailcap module, and the returned command before executing it. Issue: https://github.com/python/cpython/issues/68966 Discussions to security-sig(a)python.org. Cheers, Steve Dower Python Security Response Team

2 1

Re: [Security-announce]Incident Report: Malicious takeover of ctx project on PyPI
by Skip Montanaro May 31, 2022

May 31, 2022

> Takeover of the ctx project was reported on multiple channels overnight and was mitigated as of 6:07 AM Eastern. Ee, Thanks for the quick action by the Python infrastructure and security teams. I don't normally dig into such things, but was curious. I found the incident report clear, and since the exploit was very simple and written in Python, I actually understood it. (Many hacks these days seem obscure, especially stuff involving buffer overruns or use-after-free.) But I digress. Reading the report raised a couple questions for me. 1. Would requiring 2FA for all PyPI accounts be reasonable? 2. This might seem odd, but would it also be reasonable to require accounts to be associated with a large, well-known email service provider? That second one would seem to be pretty debatable, but the odds of, say, gmail.com or outlook.com, expiring and being reregistered would seem pretty slim. It's much more likely that an individual's account would simply be hacked. Hmmm... Maybe I should just retract that idea. I think #1 might help, however. Again, thanks... Skip Montanaro

3 2