p PatchFirst

ALPINE-CVE-2015-20107

ALPINE-CVE-2015-20107

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9

CVSS 7.6 · High · Fix available

Published
Updated

Stack: system

Affected products and versions

  • python3 Alpine:v3.17

    Affected ranges
    • ECOSYSTEM: < 3.10.5-r0

    Update to 3.10.5-r0

  • python3 Alpine:v3.18

    Affected ranges
    • ECOSYSTEM: < 3.10.5-r0

    Update to 3.10.5-r0

  • python3 Alpine:v3.19

    Affected ranges
    • ECOSYSTEM: < 3.10.5-r0

    Update to 3.10.5-r0

  • python3 Alpine:v3.20

    Affected ranges
    • ECOSYSTEM: < 3.10.5-r0

    Update to 3.10.5-r0

  • python3 Alpine:v3.21

    Affected ranges
    • ECOSYSTEM: < 3.10.5-r0

    Update to 3.10.5-r0

  • python3 Alpine:v3.22

    Affected ranges
    • ECOSYSTEM: < 3.10.5-r0

    Update to 3.10.5-r0

  • python3 Alpine:v3.23

    Affected ranges
    • ECOSYSTEM: < 3.10.5-r0

    Update to 3.10.5-r0

  • python3 Alpine:v3.24

    Affected ranges
    • ECOSYSTEM: < 3.10.5-r0

    Update to 3.10.5-r0

Original sources

Check your server →