REDHAT-BUG-482814
First published: Wed Jan 28 2009(Updated: )
Common Vulnerabilities and Exposures assigned an identifier <a href="https://access.redhat.com/security/cve/CVE-2008-5983">CVE-2008-5983</a> to the following vulnerability: Untrusted search path vulnerability in the PySys_SetArgv API function in Python before 2.6 prepends an empty string to sys.path when the argv[0] argument does not contain a path separator, which might allow local users to execute arbitrary code via a Trojan horse Python file in the current working directory. References: <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5983">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5983</a> <a href="http://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg586010.html">http://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg586010.html</a> <a href="http://www.openwall.com/lists/oss-security/2009/01/26/2">http://www.openwall.com/lists/oss-security/2009/01/26/2</a> <a href="http://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.html">http://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.html</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Python 2.7 | <2.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/security/cve/CVE-2008-5983
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5983
- http://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg586010.html
- http://www.openwall.com/lists/oss-security/2009/01/26/2
- http://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.html
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=481556
- http://bugzilla.gnome.org/show_bug.cgi?id=569214
- http://bugzilla.gnome.org/show_bug.cgi?id=569273
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=330270&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=330270&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=334888&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=334888&action=edit
- http://bugs.python.org/issue5753
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=482814#c22
- http://bugs.python.org/issue5753#msg90336
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=482814#c32
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=482814#c44
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=482814#c48
- http://admin.fedoraproject.org/updates/python-2.6.2-8.fc12
- http://admin.fedoraproject.org/updates/python-2.6.4-27.fc13
- http://admin.fedoraproject.org/updates/python-2.6-14.fc11
- http://admin.fedoraproject.org/updates/python3-3.1.2-6.fc13
- http://admin.fedoraproject.org/updates/python26-2.6.5-5.el5
- https://rhn.redhat.com/errata/RHSA-2011-0027.html
- https://bugzilla.redhat.com/show_bug.cgi?id=482814
Frequently Asked Questions
What is the severity of REDHAT-BUG-482814?
The severity of REDHAT-BUG-482814 is categorized as medium due to the untrusted search path vulnerability.
How do I fix REDHAT-BUG-482814?
To fix REDHAT-BUG-482814, upgrade to Python version 2.6 or later.
What systems are affected by REDHAT-BUG-482814?
REDHAT-BUG-482814 affects all versions of Python prior to 2.6.
What kind of vulnerability is REDHAT-BUG-482814?
REDHAT-BUG-482814 is an untrusted search path vulnerability in the PySys_SetArgv API function.
How can REDHAT-BUG-482814 be exploited?
REDHAT-BUG-482814 can be exploited by manipulating the search path used for loading modules, leading to code execution.
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2008-5983
- agent/references
- agent/severity
- agent/description
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/python
- canonical/python 2.7