Published: 23/08/2023 Updated: 07/11/2023

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 0

An issue exists in Python 3.11 up to and including 3.11.4. If a path containing '\0' bytes is passed to os.path.normpath(), the path will be truncated unexpectedly at the first '\0' byte. There are plausible cases in which an application would have rejected a filename for security reasons in Python 3.10.x or earlier, but that filename is no longer rejected in Python 3.11.x.

Vulnerable Product	Search on Vulmon	Subscribe to Product
python python
netapp active iq unified manager -

Synopsis Moderate: python311 security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for python311 is now available for Red Hat Enterprise Linux 9Red Hat Product Security has rated this update as havin ...

Synopsis Moderate: python311 security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for python311 is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as havin ...

DescriptionPython 311 ospathnormpath() function is vulnerable to path truncation if a null byte is inserted in the middle of passed path This may result in bypass of allow lists if implemented before the verification of the pathPython 311 ospathnormpath() function is vulnerable to path truncation if a null byte is inserted in the mid ...

CWE-426 https://github.com/python/cpython/pull/107982 https://github.com/python/cpython/pull/107983 https://github.com/python/cpython/pull/107981 https://github.com/python/cpython/issues/106242 https://security.netapp.com/advisory/ntap-20231006-0015/https://mail.python.org/archives/list/security-announce%40python.org/thread/D6CDW3ZZC5D444YGL3VQUY6D4ECMCQLD/https://access.redhat.com/errata/RHSA-2023:6494 https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2023-41105

CVE-2023-41105

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect