CVE-2008-5983: Medium severity Python Python vulnerability
Common Vulnerabilities and Exposures assigned an identifier CVE-2008-5983 to the following vulnerability:
Untrusted search path vulnerability in the PySysSetArgv API function in Python before 2.6 prepends an empty string to sys.path when the argv[0] argument does not contain a path separator, which might allow local users to execute arbitrary code via a Trojan horse Python file in the current working directory.
References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5983 http://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg586010.html http://www.openwall.com/lists/oss-security/2009/01/26/2 http://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.html
Other sources
Untrusted search path vulnerability in the PySysSetArgv API function in Python 2.6 and earlier, and possibly later versions, prepends an empty string to sys.path when the argv[0] argument does not contain a path separator, which might allow local users to execute arbitrary code via a Trojan horse Python file in the current working directory.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/pythonto a version that resolves this vulnerability.Fixed in 0:2.4.3-43.el5
Event History
Frequently Asked Questions
What is CVE-2008-5983?
CVE-2008-5983 is a vulnerability in the PySys_SetArgv API function in Python 2.6 and earlier that allows local users to execute arbitrary code via a Trojan horse P…
Which software versions are affected by CVE-2008-5983?
Python 2.6 and earlier, and possibly later versions, are affected by CVE-2008-5983.
How severe is CVE-2008-5983?
CVE-2008-5983 has a severity rating of 6.9 (medium).
How can I fix CVE-2008-5983?
There are no specific fixes mentioned for CVE-2008-5983. It is recommended to update to the latest version of Python to mitigate the vulnerability.
Where can I find more information about CVE-2008-5983?
You can find more information about CVE-2008-5983 at the following references: [link1](http://www.openwall.com/lists/oss-security/2009/01/26/2), [link2](http://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg586010.html), [link3](http://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.html)