CVE-2023-41105

Katalog CVE

CVSS 7.5 · High EPSS 2,6%

Kerentanan Untrusted Search Path pada python, netapp active iq unified manager. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.normpath(), the path will be truncated unexpectedly at the first '\0' byte. There are plausible cases in which an application would have rejected a filename for security reasons in Python 3.10.x or earlier, but that filename is no longer rejected in Python 3.11.x.

Rincian

Terbit di NVD

23 Agustus 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-426: Untrusted Search Path

EPSS (30 hari)

2,6% peluang dieksploitasi; lebih tinggi dari 84,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/python/cpython/issues/106242 issue tracking · patch
• https://github.com/python/cpython/pull/107981 patch
• https://github.com/python/cpython/pull/107982 patch
• https://github.com/python/cpython/pull/107983 patch
• https://security.netapp.com/advisory/ntap-20231006-0015/ advisory pihak ketiga
• https://mail.python.org/archives/list/security-announce%40python.org/thread/D6CDW3ZZC5D444YGL3VQUY6D4ECMCQLD/