CVE-2019-13404
First published: Mon Jul 08 2019(Updated: )
** DISPUTED ** The MSI installer for Python through 2.7.16 on Windows defaults to the C:\Python27 directory, which makes it easier for local users to deploy Trojan horse code. (This also affects old 3.x releases before 3.5.) NOTE: the vendor's position is that it is the user's responsibility to ensure C:\Python27 access control or choose a different directory, because backwards compatibility requires that C:\Python27 remain the default for 2.7.x.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Python Python | <=2.7.16 | |
| Python Python | >=3.0.0<3.5.0 | |
| Microsoft Windows | ||
| All of | ||
| Any of | ||
| Python Python | <=2.7.16 | |
| Python Python | >=3.0.0<3.5.0 | |
| Microsoft Windows |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-13404?
CVE-2019-13404 is a vulnerability in the MSI installer for Python through 2.7.16 and old 3.x releases before 3.5 on Windows, which defaults to the C:\Python27 directory, potentially allowing local users to deploy Trojan horse code.
How does CVE-2019-13404 affect users?
CVE-2019-13404 affects users of Python through 2.7.16 and old 3.x releases before 3.5 on Windows, as the default installation directory makes it easier for local users to deploy malicious code.
What is the severity of CVE-2019-13404?
CVE-2019-13404 has a severity rating of 7.8 (critical).
How can users fix CVE-2019-13404?
To fix CVE-2019-13404, users should ensure that they install Python in a directory other than C:\Python27 and regularly update to the latest version of Python.
Where can I find more information about CVE-2019-13404?
More information about CVE-2019-13404 can be found at the following link: [Python FAQ](https://docs.python.org/2/faq/windows.html)
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/severity
- agent/weakness
- agent/references
- agent/last-modified-date
- agent/author
- agent/status
- agent/softwarecombine
- agent/tags
- agent/description
- agent/event
- status/disputed
- vendor/python
- canonical/python python
- version/python python/2.7.16
- version/python python/3.0.0
- vendor/microsoft
- canonical/microsoft windows