[security][CVE-2020-27619] Python testsuite calls eval() on content received via HTTP #86110
Description
Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.
Show more details
GitHub fields:
assignee = None
closed_at = <Date 2020-10-20.04:47:52.035>
created_at = <Date 2020-10-05.14:40:52.277>
labels = ['type-security', '3.8', '3.9', '3.10', '3.7', 'tests']
title = '[security][CVE-2020-27619] Python testsuite calls eval() on content received via HTTP'
updated_at = <Date 2020-11-04.13:09:52.449>
user = 'https://github.com/serhiy-storchaka'bugs.python.org fields:
activity = <Date 2020-11-04.13:09:52.449>
actor = 'vstinner'
assignee = 'none'
closed = True
closed_date = <Date 2020-10-20.04:47:52.035>
closer = 'ned.deily'
components = ['Tests']
creation = <Date 2020-10-05.14:40:52.277>
creator = 'serhiy.storchaka'
dependencies = []
files = []
hgrepos = []
issue_num = 41944
keywords = ['patch', 'security_issue']
message_count = 19.0
messages = ['378036', '378104', '378105', '378106', '378107', '378108', '378110', '378111', '378114', '378117', '378118', '378119', '378120', '378125', '379082', '379085', '379713', '380319', '380320']
nosy_count = 7.0
nosy_names = ['vstinner', 'ned.deily', 'zach.ware', 'serhiy.storchaka', 'The Compiler', 'pablogsal', 'miss-islington']
pr_nums = ['22566', '22575', '22576', '22577', '22578', '22579']
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue41944'
versions = ['Python 3.6', 'Python 3.7', 'Python 3.8', 'Python 3.9', 'Python 3.10']
Activity
serhiy-storchaka commentedon Oct 5, 2020
As was reported by Florian Bruhin, Python testsuite calls eval() on content received via HTTP (in Lib/test/multibytecodec_support.py).
The-Compiler commentedon Oct 6, 2020
I wonder if I should request a CVE for this as well? Just to make sure the word gets out to distributions/organizations/etc. running the Python testsuite, given that we can't be sure it which contexts this happens (and as it could be exploited by e.g. spoofing a WiFi network or so).
vstinner commentedon Oct 6, 2020
I don't think that a CVE is justified.
I don't know anyone running the Python test suite on production. Only developers of Python itself run Python.
[-]Python testsuite calls eval() on content received via HTTP[/-][+][security] Python testsuite calls eval() on content received via HTTP[/+][-]Python testsuite calls eval() on content received via HTTP[/-][+][security] Python testsuite calls eval() on content received via HTTP[/+]12 remaining items
ned-deily commentedon Oct 20, 2020
New changeset e912e94 by Miss Skeleton (bot) in branch '3.6':
bpo-41944: No longer call eval() on content received via HTTP in the CJK codec tests (GH-22566) (GH-22579)
e912e94
vstinner commentedon Oct 27, 2020
Thanks for the fix Serhiy and thanks Florian Bruhin for the bug report!
vstinner commentedon Nov 4, 2020
The CVE-2020-27619 has been assigned to this issue.
[-][security] Python testsuite calls eval() on content received via HTTP[/-][+][security][CVE-2020-27619] Python testsuite calls eval() on content received via HTTP[/+][-][security] Python testsuite calls eval() on content received via HTTP[/-][+][security][CVE-2020-27619] Python testsuite calls eval() on content received via HTTP[/+]vstinner commentedon Nov 4, 2020
Red Hat advisory: https://access.redhat.com/security/cve/CVE-2020-27619
serhiy-storchaka commentedon Jul 23, 2022
@gvanrossum, is there anything else that needs to be done in this issue?
gvanrossum commentedon Jul 23, 2022
Whoops, didn’t mean to reopen. This has happened a few times — I look at an issue, maybe subscribe, and it gets reopened?