CVE-2024-3220: Default mimetype known files writeable on Windows
There is a defect in the CPython standard library module “mimetypes” where on Windows the default list of known file locations are writable meaning other users can create invalid files to cause MemoryError to be raised on Python runtime startup or have file extensions be interpreted as the incorrect file type.
This defect is caused by the default locations of Linux and macOS platforms (such as “/etc/mime.types”) also being used on Windows, where they are user-writable locations (“C:\etc\mime.types”).
To work-around this issue a user can call mimetypes.init() with an empty list (“[]”) on Windows platforms to avoid using the default list of known file locations.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3220?
The CVE-2024-3220 vulnerability is considered a medium severity issue due to potential exploitation affecting Python runtime stability.
Which versions of CPython are affected by CVE-2024-3220?
CVE-2024-3220 affects multiple versions of CPython on Windows where known file locations are writable.
How do I fix CVE-2024-3220?
To mitigate CVE-2024-3220, ensure that the default writable list of file locations used by the mimetypes module is properly secured or updated.
What kind of attack is possible with CVE-2024-3220?
Exploiting CVE-2024-3220 could allow attackers to create invalid files that trigger MemoryError upon CPython startup.
Is the CVE-2024-3220 vulnerability specific to Windows?
Yes, CVE-2024-3220 specifically impacts CPython running on the Windows operating system.