Homepage
About Snyk

Untrusted Search Path Affecting python3.11 package, versions *

low

Snyk CVSS

    Attack Complexity Low
    Integrity High

    Threat Intelligence

    EPSS 0.06% (22nd percentile)
Expand this section
NVD
7.5 high
Expand this section
SUSE
6.7 medium
Expand this section
Red Hat
7.5 high

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-DEBIAN12-PYTHON311-5853785
  • published 24 Aug 2023
  • disclosed 23 Aug 2023
Report a new vulnerability Found a mistake?

Introduced: 23 Aug 2023

CVE-2023-41105 Open this link in a new tab
CWE-426 Open this link in a new tab

How to fix?

There is no fixed version for Debian:12 python3.11.

NVD Description

Note: Versions mentioned in the description apply only to the upstream python3.11 package and not the python3.11 package as distributed by Debian. See How to fix? for Debian:12 relevant fixed versions and status.

An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.normpath(), the path will be truncated unexpectedly at the first '\0' byte. There are plausible cases in which an application would have rejected a filename for security reasons in Python 3.10.x or earlier, but that filename is no longer rejected in Python 3.11.x.