CVE-2017-17522: High severity Python Python vulnerability
DISPUTED Lib/webbrowser.py in Python through 3.6.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a software maintainer indicates that exploitation is impossible because the code relies on subprocess.Popen and the default shell=False setting.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-17522?
CVE-2017-17522 is classified as a disputed vulnerability, suggesting potential risks for argument-injection attacks.
How does CVE-2017-17522 affect affected software packages?
CVE-2017-17522 affects various Python versions, including Python 3.6.3 and earlier, as well as Jython and Python 2.7.18.
Can CVE-2017-17522 be exploited remotely?
Yes, CVE-2017-17522 may allow remote attackers to exploit the vulnerability through specially crafted URLs.
How do I fix CVE-2017-17522?
To mitigate CVE-2017-17522, it's recommended to upgrade to a version of Python that properly validates the BROWSER environment variable.
Is the impact of CVE-2017-17522 limited to Python?
While primarily affecting Python, the vulnerability can impact applications that rely on the affected versions of the language.