CVE-2008-5983
Summary
| CVE | CVE-2008-5983 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2009-01-28 02:30:00 UTC |
| Updated | 2023-11-07 02:03:00 UTC |
| Description | Untrusted search path vulnerability in the PySys_SetArgv API function in Python 2.6 and earlier, and possibly later versions, prepends an empty string to sys.path when the argv[0] argument does not contain a path separator, which might allow local users to execute arbitrary code via a Trojan horse Python file in the current working directory. |
Risk And Classification
Problem Types: CWE-426
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Canonical | Ubuntu Linux | 10.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 11.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 11.10 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 8.04 | All | All | All |
| Operating System | Fedoraproject | Fedora | 13 | All | All | All |
| Application | Python | Python | All | All | All | All |
| Application | Python Software Foundation | Python | 1.5.2 | All | All | All |
| Application | Python Software Foundation | Python | 1.6 | All | All | All |
| Application | Python Software Foundation | Python | 1.6.1 | All | All | All |
| Application | Python Software Foundation | Python | 2.0 | All | All | All |
| Application | Python Software Foundation | Python | 2.0.1 | All | All | All |
| Application | Python Software Foundation | Python | 2.1 | All | All | All |
| Application | Python Software Foundation | Python | 2.1.1 | All | All | All |
| Application | Python Software Foundation | Python | 2.1.2 | All | All | All |
| Application | Python Software Foundation | Python | 2.1.3 | All | All | All |
| Application | Python Software Foundation | Python | 2.2 | All | All | All |
| Application | Python Software Foundation | Python | 2.2.1 | All | All | All |
| Application | Python Software Foundation | Python | 2.2.2 | All | All | All |
| Application | Python Software Foundation | Python | 2.2.3 | All | All | All |
| Application | Python Software Foundation | Python | 2.3 | All | All | All |
| Application | Python Software Foundation | Python | 2.3.1 | All | All | All |
| Application | Python Software Foundation | Python | 2.3.2 | All | All | All |
| Application | Python Software Foundation | Python | 2.3.3 | All | All | All |
| Application | Python Software Foundation | Python | 2.3.4 | All | All | All |
| Application | Python Software Foundation | Python | 2.3.5 | All | All | All |
| Application | Python Software Foundation | Python | 2.3.6 | All | All | All |
| Application | Python Software Foundation | Python | 2.3.7 | All | All | All |
| Application | Python Software Foundation | Python | 2.4 | All | All | All |
| Application | Python Software Foundation | Python | 2.4.1 | All | All | All |
| Application | Python Software Foundation | Python | 2.4.2 | All | All | All |
| Application | Python Software Foundation | Python | 2.4.3 | All | All | All |
| Application | Python Software Foundation | Python | 2.4.4 | All | All | All |
| Application | Python Software Foundation | Python | 2.4.5 | All | All | All |
| Application | Python Software Foundation | Python | 2.4.6 | All | All | All |
| Application | Python Software Foundation | Python | 2.5 | All | All | All |
| Application | Python Software Foundation | Python | 2.5.1 | All | All | All |
| Application | Python Software Foundation | Python | 2.5.2 | All | All | All |
| Application | Python Software Foundation | Python | 2.5.4 | All | All | All |
| Application | Python Software Foundation | Python | 1.5.2 | All | All | All |
| Application | Python Software Foundation | Python | 1.6 | All | All | All |
| Application | Python Software Foundation | Python | 1.6.1 | All | All | All |
| Application | Python Software Foundation | Python | 2.0 | All | All | All |
| Application | Python Software Foundation | Python | 2.0.1 | All | All | All |
| Application | Python Software Foundation | Python | 2.1 | All | All | All |
| Application | Python Software Foundation | Python | 2.1.1 | All | All | All |
| Application | Python Software Foundation | Python | 2.1.2 | All | All | All |
| Application | Python Software Foundation | Python | 2.1.3 | All | All | All |
| Application | Python Software Foundation | Python | 2.2 | All | All | All |
| Application | Python Software Foundation | Python | 2.2.1 | All | All | All |
| Application | Python Software Foundation | Python | 2.2.2 | All | All | All |
| Application | Python Software Foundation | Python | 2.2.3 | All | All | All |
| Application | Python Software Foundation | Python | 2.3 | All | All | All |
| Application | Python Software Foundation | Python | 2.3.1 | All | All | All |
| Application | Python Software Foundation | Python | 2.3.2 | All | All | All |
| Application | Python Software Foundation | Python | 2.3.3 | All | All | All |
| Application | Python Software Foundation | Python | 2.3.4 | All | All | All |
| Application | Python Software Foundation | Python | 2.3.5 | All | All | All |
| Application | Python Software Foundation | Python | 2.3.6 | All | All | All |
| Application | Python Software Foundation | Python | 2.3.7 | All | All | All |
| Application | Python Software Foundation | Python | 2.4 | All | All | All |
| Application | Python Software Foundation | Python | 2.4.1 | All | All | All |
| Application | Python Software Foundation | Python | 2.4.2 | All | All | All |
| Application | Python Software Foundation | Python | 2.4.3 | All | All | All |
| Application | Python Software Foundation | Python | 2.4.4 | All | All | All |
| Application | Python Software Foundation | Python | 2.4.5 | All | All | All |
| Application | Python Software Foundation | Python | 2.4.6 | All | All | All |
| Application | Python Software Foundation | Python | 2.5 | All | All | All |
| Application | Python Software Foundation | Python | 2.5.1 | All | All | All |
| Application | Python Software Foundation | Python | 2.5.2 | All | All | All |
| Application | Python Software Foundation | Python | 2.5.4 | All | All | All |
| Application | Python Software Foundation | Python | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| oss-security - Re: CVE request -- Python < 2.6 PySys_SetArgv issues (epiphany, csound, dia, eog, gedit, xchat, vim, nautilus-python, Gnumeric) | MLIST | www.openwall.com | |
| Security Advisory SA50858 - Ubuntu update for python - Secunia | SECUNIA | secunia.com | |
| Bug#493937: [Patch] Prevent loading of Python modules in working directo | MLIST | www.mail-archive.com | |
| Gentoo Linux Documentation -- Eye of GNOME: Untrusted search path | GENTOO | security.gentoo.org | |
| oss-security - Re: CVE request -- Python < 2.6 PySys_SetArgv issues (epiphany, csound, dia, eog, gedit, xchat, vim, nautilus-python, Gnumeric) | MLIST | www.openwall.com | |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | VUPEN | www.vupen.com | Vendor Advisory |
| Gentoo update for gedit - Secunia.com | SECUNIA | secunia.com | Vendor Advisory |
| USN-1596-1: Python 2.6 vulnerabilities | Ubuntu | UBUNTU | www.ubuntu.com | |
| Fedora update for python - Secunia.com | SECUNIA | secunia.com | Vendor Advisory |
| oss-security - CVE request -- Python < 2.6 PySys_SetArgv issues (epiphany, csound, dia, eog, gedit, xchat, vim, nautilus-python, Gnumeric) | MLIST | www.openwall.com | |
| USN-1613-2: Python 2.4 vulnerabilities | Ubuntu | UBUNTU | www.ubuntu.com | |
| Security Advisory SA51024 - Ubuntu update for python2.5 - Secunia | SECUNIA | secunia.com | |
| Support | Red Hat | REDHAT | www.redhat.com | |
| Bug#493937: [Patch] Prevent loading of Python modules in working directo | www.mail-archive.com | ||
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | VUPEN | www.vupen.com | Vendor Advisory |
| Bug 482814 – CVE-2008-5983 python: untrusted python modules search path | MISC | bugzilla.redhat.com | |
| USN-1616-1: Python 3.1 vulnerabilities | Ubuntu | UBUNTU | www.ubuntu.com | |
| Old Nabble - debian-bugs-rc - Bug#484305: bicyclerepair: bike.vim imports untrusted python files from cwd | MLIST | www.nabble.com | |
| USN-1613-1: Python 2.5 vulnerabilities | Ubuntu | UBUNTU | www.ubuntu.com | |
| Red Hat update for python - Advisories - Community | SECUNIA | secunia.com | Vendor Advisory |
| Security Advisory SA51087 - Ubuntu update for python3.1 - Secunia | SECUNIA | secunia.com | |
| Security Advisory SA51040 - Ubuntu update for python2.4 - Secunia | SECUNIA | secunia.com | |
| Gentoo Linux Documentation -- gedit: Untrusted search path | GENTOO | security.gentoo.org | |
| [SECURITY] Fedora 13 Update: python-2.6.4-27.fc13 | FEDORA | lists.fedoraproject.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.