An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.normpath(), the path will be truncated unexpectedly at the first '\0' byte. There are plausible cases in which an application would have rejected a filename for security reasons in Python 3.10.x or earlier, but that filename is no longer rejected in Python 3.11.x.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3.11-libsUpgrade python3.11Upgrade python3.11-testUpgrade python3.11-develUpgrade python3.11-tkinterUpgrade python3.11-debugUpgrade python3.11-idleUpgrade python3.11-rpm-macros | Nov 16, 2023 | Aug 23, 2023 |
| Amazon_linux_2023 | — | Upgrade python3.11Upgrade python3.11-debugUpgrade python3.11-develUpgrade python3.11-testUpgrade python3.11-tkinterUpgrade python3.11-idleUpgrade python3.11-libsUpgrade python3.11-debugsourceUpgrade python3.11-debuginfo | Feb 17, 2025 | Aug 23, 2023 |
| Centos_linux | — | Upgrade python3.11-develUpgrade python3.11-debuginfoUpgrade python3.11Upgrade python3.11-debugsourceUpgrade python3.11-libsUpgrade python3.11-tkinterUpgrade python3.11-rpm-macros | Nov 8, 2023 | Aug 23, 2023 |
| Debian | — | Upgrade python3.11 | Jul 30, 2024 | Aug 23, 2023 |
| Gentoo Linux | — | Upgrade dev-python/pypy3.Upgrade dev-lang/python.Upgrade dev-python/pypy3_10.Upgrade dev-python/pypy3_9. | May 6, 2024 | Aug 23, 2023 |
| Oracle_linux | — | Upgrade python3.11-rpm-macrosUpgrade python3.11-tkinterUpgrade python3.11Upgrade python3.11-testUpgrade python3.11-debugUpgrade python3.11-develUpgrade python3.11-idleUpgrade python3.11-libs | Nov 22, 2023 | Aug 23, 2023 |
| Rapid7 Insightagent | — | Upgrade Rapid7 Insight Agent to version 4.0.6.14 | Mar 19, 2024 | Aug 23, 2023 |
| Redhat_linux | — | Upgrade python3.11-debugUpgrade python3.11-develUpgrade python3.11-debuginfoUpgrade python3.11-testUpgrade python3.11Upgrade python3.11-debugsourceUpgrade python3.11-tkinterUpgrade python3.11-libsUpgrade python3.11-rpm-macrosUpgrade python3.11-idle | Nov 8, 2023 | Aug 23, 2023 |
| Suse | — | Upgrade python3Upgrade libpython3_4m1_0-32bitUpgrade python311-testsuiteUpgrade libpython3_11-1_0Upgrade python311-develUpgrade python3-dbmUpgrade python3-baseUpgrade python311-idleUpgrade python311-dbmUpgrade python311-toolsUpgrade libpython3_11-1_0-32bitUpgrade python311-base-32bitUpgrade python311-baseUpgrade python311-doc-devhelpUpgrade python3-develUpgrade python3-tkUpgrade python3-cursesUpgrade python311-32bitUpgrade python311-docUpgrade libpython3_4m1_0Upgrade python311-tkUpgrade python311-cursesUpgrade python311 | Oct 4, 2023 | Aug 23, 2023 |
| Ubuntu | — | Upgrade python3.11 (Ubuntu Pro)Upgrade python3.11Upgrade python3.10Upgrade python3.11-minimal (Ubuntu Pro)Upgrade python3.10-minimal | Dec 12, 2023 | Aug 23, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 23, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub