DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation has been updated to clarify this point. There is no vulnerability in the function if following the intended security model.
pkgutil.get_data() did not validate the resource argument as documented, allowing path traversals.
CVSS Details
- CVSS 4.0 Base Score: 0 (NONE)
- CVSS 4.0 Vector: (CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade python3-debuginfoUpgrade python3-toolsUpgrade python3-develUpgrade python-debugUpgrade pythonUpgrade python3-libsUpgrade python-debuginfoUpgrade python-toolsUpgrade python3Upgrade python-libsUpgrade tkinterUpgrade python3-testUpgrade python3-tkinterUpgrade python-develUpgrade python-testUpgrade python3-debug | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade python3-develUpgrade python3-tkinterUpgrade python3-idleUpgrade python3.9-debuginfoUpgrade python3.9-debugsourceUpgrade python3-libsUpgrade python-unversioned-commandUpgrade python3Upgrade python3-debugUpgrade python3-test | Jul 8, 2026 | Mar 18, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Mar 18, 2026 |
| Suse | — | Upgrade python313-testsuiteUpgrade libpython2_7-1_0Upgrade libpython3_14-1_0Upgrade python-develUpgrade python3-docUpgrade python310-tkUpgrade python312-docUpgrade libpython3_10-1_0-32bitUpgrade libpython3_4m1_0-32bitUpgrade python-xmlUpgrade python3-doc-devhelpUpgrade python312-cursesUpgrade python-base-32bitUpgrade python313Upgrade python312-base-32bitUpgrade python39-cursesUpgrade python310Upgrade python313-nogil-toolsUpgrade python-doc-pdfUpgrade python311-cursesUpgrade python-tkUpgrade python313-base-x86-64-v3Upgrade python313-nogil-develUpgrade python313-nogil-idleUpgrade python314-toolsUpgrade python311-doc-devhelpUpgrade python3-dbmUpgrade libpython3_14-1_0-x86-64-v3Upgrade python310-baseUpgrade python310-base-32bitUpgrade python314Upgrade python311-baseUpgrade python311-base-32bitUpgrade python313-doc-devhelpUpgrade python310-docUpgrade python313-nogil-cursesUpgrade python314-dbmUpgrade python314-tkUpgrade libpython3_13-1_0-x86-64-v3Upgrade python3Upgrade python311-toolsUpgrade python-idleUpgrade python313-nogilUpgrade python313-nogil-testsuiteUpgrade python310-testsuiteUpgrade python311-develUpgrade python314-base-x86-64-v3Upgrade python3-toolsUpgrade python311-dbmUpgrade python312-testsuiteUpgrade python314-x86-64-v3Upgrade python313-toolsUpgrade python-baseUpgrade libpython3_12-1_0-32bitUpgrade python314-idleUpgrade python3-testsuiteUpgrade python-docUpgrade libpython3_11-1_0-32bitUpgrade libpython3_13-1_0Upgrade libpython2_7-1_0-32bitUpgrade libpython3_11-1_0Upgrade python-demoUpgrade python312-dbmUpgrade python313-baseUpgrade python312-idleUpgrade python313-idleUpgrade python313-docUpgrade python36-develUpgrade python39-dbmUpgrade libpython3_10-1_0Upgrade python313-develUpgrade python314-baseUpgrade python312-toolsUpgrade python312Upgrade python313-nogil-dbmUpgrade python310-cursesUpgrade pythonUpgrade python312-develUpgrade python313-nogil-baseUpgrade python312-tkUpgrade python313-dbmUpgrade python3-tkUpgrade python311-docUpgrade python3-cursesUpgrade libpython3_6m1_0Upgrade python314-cursesUpgrade libpython3_4m1_0Upgrade python39-baseUpgrade python36Upgrade python312-baseUpgrade python311-tkUpgrade python311-idleUpgrade python3-idleUpgrade python312-doc-devhelpUpgrade python310-develUpgrade python310-32bitUpgrade python-gdbmUpgrade python36-baseUpgrade python314-docUpgrade python313-nogil-tkUpgrade python310-dbmUpgrade python311-32bitUpgrade python311Upgrade python-cursesUpgrade libpython3_9-1_0Upgrade libpython3_12-1_0Upgrade python311-testsuiteUpgrade libpython3_6m1_0-32bitUpgrade python39Upgrade python312-32bitUpgrade python310-toolsUpgrade python310-doc-devhelpUpgrade python3-develUpgrade python313-x86-64-v3Upgrade python313-cursesUpgrade python310-idleUpgrade python314-doc-devhelpUpgrade python314-develUpgrade python313-tkUpgrade python-32bitUpgrade libpython3_13t1_0Upgrade python3-base | Apr 14, 2026 | Apr 13, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Mar 18, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub