Critical · published October 22, 2020
⚠️ A sneaky little test in Python 3.9.0 could expose you to risks if it processes untrusted HTTP content—think of it as a chef tasting a mystery dish without checking the ingredients first! It's like a restaurant where a waiter samples a dish without knowing whether it contains allergens. Just because it's on the menu doesn’t mean it’s safe, right? An attacker could potentially inject malicious code through HTTP responses, leading to unexpected behaviors or vulnerabilities within the application. While this flaw isn't widely exploited just yet, the potential for a tasty disaster is there, waiting to be served.
It's like a restaurant where a waiter samples a dish without knowing whether it contains allergens. Just because it's on the menu doesn’t mean it’s safe, right? This vulnerability arises from the use of eval() in Python's multibyte codec tests, which can execute arbitrary code if the fetched content from HTTP is not properly sanitized.
An attacker could potentially inject malicious code through HTTP responses, leading to unexpected behaviors or vulnerabilities within the application. While this flaw isn't widely exploited just yet, the potential for a tasty disaster is there, waiting to be served. Although this isn't currently exploited, it's wise to avoid using eval() on untrusted input. Review your codebase for any HTTP content retrieval that uses eval() and replace it with safer alternatives. Keep your Python environment updated to the latest version as it may contain security improvements. You've got this! With a little vigilance and these steps, you can keep your code safe and sound. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| python/python | ≥ 3.0.0, < 3.6.13 | 3.6.13 |
| python/python | ≥ 3.7.0, < 3.7.10 | 3.7.10 |
| python/python | ≥ 3.8.0, < 3.8.7 | 3.8.7 |
| python/python | ≥ 3.9.0, < 3.9.1 | 3.9.1 |
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |
| oracle/communications_cloud_native_core_network_function_cloud_native_environment | all versions | — |