CVE-2019-13404: Critical severity python 2.7 vulnerability
DISPUTED The MSI installer for Python through 2.7.16 on Windows defaults to the C:\Python27 directory, which makes it easier for local users to deploy Trojan horse code. (This also affects old 3.x releases before 3.5.) NOTE: the vendor's position is that it is the user's responsibility to ensure C:\Python27 access control or choose a different directory, because backwards compatibility requires that C:\Python27 remain the default for 2.7.x.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-13404?
CVE-2019-13404 is a vulnerability in the MSI installer for Python through 2.7.16 and old 3.x releases before 3.5 on Windows, which defaults to the C:\Python27 directory, potentially allowing local users to deploy Trojan horse code.
How does CVE-2019-13404 affect users?
CVE-2019-13404 affects users of Python through 2.7.16 and old 3.x releases before 3.5 on Windows, as the default installation directory makes it easier for local users to deploy malicious code.
What is the severity of CVE-2019-13404?
CVE-2019-13404 has a severity rating of 7.8 (critical).
How can users fix CVE-2019-13404?
To fix CVE-2019-13404, users should ensure that they install Python in a directory other than C:\Python27 and regularly update to the latest version of Python.
Where can I find more information about CVE-2019-13404?
More information about CVE-2019-13404 can be found at the following link: [Python FAQ](https://docs.python.org/2/faq/windows.html)