Your submission was sent successfully! Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

CVE-2020-15523

Published: 4 July 2020

In Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a Trojan horse python3.dll might be used in cases where CPython is embedded in a native application. This occurs because python3X.dll may use an invalid search path for python3.dll loading (after Py_SetPath has been used). NOTE: this issue CANNOT occur when using python.exe from a standard (non-embedded) Python installation on Windows.

Notes

AuthorNote
mdeslaur
windows-specific issue, doesn't affect Ubuntu

Priority

Unknown

Cvss 3 Severity Score

7.8

Score breakdown

Status

Package Release Status
python2.7
Launchpad, Ubuntu, Debian
bionic Not vulnerable

eoan Not vulnerable

focal Not vulnerable

trusty Not vulnerable

upstream Not vulnerable
(debian: Python on Windows)
xenial Not vulnerable

python3.8
Launchpad, Ubuntu, Debian
bionic Not vulnerable

eoan Not vulnerable

focal Not vulnerable

trusty Does not exist

upstream Not vulnerable
(debian: Python on Windows)
xenial Does not exist

Severity score breakdown

Parameter Value
Base score 7.8
Attack vector Local
Attack complexity Low
Privileges required None
User interaction Required
Scope Unchanged
Confidentiality High
Integrity impact High
Availability impact High
Vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H