CVE-2015-20107High· 7.6▾ MidnightPoC availableIn Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch …
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.8 · likelihood 0.6 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
7.1%
7.8 → 7.6
Last analysed / modified upstream
1 GitHub repo (last check)
In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9
python >= 3.7.0, <= 3.7.15python >= 3.8.0, <= 3.8.15python >= 3.9.0, <= 3.9.15python >= 3.10.0, < 3.10.8active_iq_unified_managerontap_select_deploy_administration_utilitysnapcenterfedora = 35fedora = 36fedora = 37Upgrade past the affected range:
python 3.10.8Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2022-45061High· 7.5An issue was discovered in Python before 3.11.1
CVE-2021-3177Critical· 9.8Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300…
CVE-2022-0391High· 7.5A flaw was found in Python, specifically within the urllib.parse module
CVE-2021-28861High· 7.4Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure
CVE-2021-4189Medium· 5.3A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode
CVE-2021-3737High· 7.5A flaw was found in python