Skip to content

[security][CVE-2020-27619] Python testsuite calls eval() on content received via HTTP #86110

Closed
Closed
[security][CVE-2020-27619] Python testsuite calls eval() on content received via HTTP#86110
Labels
3.10 (EOL)end of life3.7 (EOL)end of life3.8 (EOL)end of life3.9 (EOL)end of lifetestsTests in the Lib/test dirtype-securityA security issue

Description

@serhiy-storchaka
serhiy-storchaka
opened on Oct 5, 2020
BPO 41944
Nosy @vstinner, @ned-deily, @zware, @serhiy-storchaka, @The-Compiler, @pablogsal, @miss-islington
PRs
  • bpo-41944: No longer call eval() on content received via HTTP in the CJK codec tests #22566
  • bpo-41944: No longer call eval() on content received via HTTP in the UnicodeNames tests #22575
  • [3.9] bpo-41944: No longer call eval() on content received via HTTP in the CJK codec tests (GH-22566) #22576
  • [3.8] bpo-41944: No longer call eval() on content received via HTTP in the CJK codec tests (GH-22566) #22577
  • [3.7] bpo-41944: No longer call eval() on content received via HTTP in the CJK codec tests (GH-22566) #22578
  • [3.6] bpo-41944: No longer call eval() on content received via HTTP in the CJK codec tests (GH-22566) #22579
    		•

    Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = None
closed_at = <Date 2020-10-20.04:47:52.035>
created_at = <Date 2020-10-05.14:40:52.277>
labels = ['type-security', '3.8', '3.9', '3.10', '3.7', 'tests']
title = '[security][CVE-2020-27619] Python testsuite calls eval() on content received via HTTP'
updated_at = <Date 2020-11-04.13:09:52.449>
user = 'https://github.com/serhiy-storchaka'

    bugs.python.org fields:

    activity = <Date 2020-11-04.13:09:52.449>
actor = 'vstinner'
assignee = 'none'
closed = True
closed_date = <Date 2020-10-20.04:47:52.035>
closer = 'ned.deily'
components = ['Tests']
creation = <Date 2020-10-05.14:40:52.277>
creator = 'serhiy.storchaka'
dependencies = []
files = []
hgrepos = []
issue_num = 41944
keywords = ['patch', 'security_issue']
message_count = 19.0
messages = ['378036', '378104', '378105', '378106', '378107', '378108', '378110', '378111', '378114', '378117', '378118', '378119', '378120', '378125', '379082', '379085', '379713', '380319', '380320']
nosy_count = 7.0
nosy_names = ['vstinner', 'ned.deily', 'zach.ware', 'serhiy.storchaka', 'The Compiler', 'pablogsal', 'miss-islington']
pr_nums = ['22566', '22575', '22576', '22577', '22578', '22579']
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue41944'
versions = ['Python 3.6', 'Python 3.7', 'Python 3.8', 'Python 3.9', 'Python 3.10']

    Activity

    1. serhiy-storchaka commented on Oct 5, 2020

      @serhiy-storchaka
      serhiy-storchaka
      on Oct 5, 2020
      MemberAuthor

      As was reported by Florian Bruhin, Python testsuite calls eval() on content received via HTTP (in Lib/test/multibytecodec_support.py).

    2. serhiy-storchaka
      added
      3.10 (EOL)end of life
      3.8 (EOL)end of life
      3.9 (EOL)end of life
      testsTests in the Lib/test dir
      type-securityA security issue
      on Oct 5, 2020

    3. The-Compiler commented on Oct 6, 2020

      @The-Compiler
      The-Compilermannequin
      on Oct 6, 2020
      Mannequin

      I wonder if I should request a CVE for this as well? Just to make sure the word gets out to distributions/organizations/etc. running the Python testsuite, given that we can't be sure it which contexts this happens (and as it could be exploited by e.g. spoofing a WiFi network or so).

    4. vstinner commented on Oct 6, 2020

      @vstinner
      vstinner
      on Oct 6, 2020
      Member

      I don't think that a CVE is justified.

      I don't know anyone running the Python test suite on production. Only developers of Python itself run Python.

    5. vstinner
      changed the title [-]Python testsuite calls eval() on content received via HTTP[/-] [+][security] Python testsuite calls eval() on content received via HTTP[/+] on Oct 6, 2020
    6. vstinner
      changed the title [-]Python testsuite calls eval() on content received via HTTP[/-] [+][security] Python testsuite calls eval() on content received via HTTP[/+] on Oct 6, 2020

    7. 12 remaining items

    8. ned-deily commented on Oct 20, 2020

      @ned-deily
      ned-deily
      on Oct 20, 2020
      Member

      New changeset e912e94 by Miss Skeleton (bot) in branch '3.6':
      bpo-41944: No longer call eval() on content received via HTTP in the CJK codec tests (GH-22566) (GH-22579)
      e912e94

    9. ned-deily
      added
      3.7 (EOL)end of life
      on Oct 20, 2020
    10. ned-deily
      closed this as completedon Oct 20, 2020
    11. ned-deily
      added
      3.7 (EOL)end of life
      on Oct 20, 2020
    12. ned-deily
      closed this as completedon Oct 20, 2020

    13. vstinner commented on Oct 27, 2020

      @vstinner
      vstinner
      on Oct 27, 2020
      Member

      Thanks for the fix Serhiy and thanks Florian Bruhin for the bug report!

    14. vstinner commented on Nov 4, 2020

      @vstinner
      vstinner
      on Nov 4, 2020
      Member

      The CVE-2020-27619 has been assigned to this issue.

    15. vstinner
      changed the title [-][security] Python testsuite calls eval() on content received via HTTP[/-] [+][security][CVE-2020-27619] Python testsuite calls eval() on content received via HTTP[/+] on Nov 4, 2020
    16. vstinner
      changed the title [-][security] Python testsuite calls eval() on content received via HTTP[/-] [+][security][CVE-2020-27619] Python testsuite calls eval() on content received via HTTP[/+] on Nov 4, 2020

    17. vstinner commented on Nov 4, 2020

      @vstinner
      vstinner
      on Nov 4, 2020
      Member

      Red Hat advisory: https://access.redhat.com/security/cve/CVE-2020-27619

    18. ezio-melotti
      transferred this issue fromon Apr 10, 2022
    19. gvanrossum
      reopened this on Jul 22, 2022

    20. serhiy-storchaka commented on Jul 23, 2022

      @serhiy-storchaka
      serhiy-storchaka
      on Jul 23, 2022
      MemberAuthor

      @gvanrossum, is there anything else that needs to be done in this issue?

    21. gvanrossum commented on Jul 23, 2022

      @gvanrossum
      gvanrossum
      on Jul 23, 2022
      Member

      Whoops, didn’t mean to reopen. This has happened a few times — I look at an issue, maybe subscribe, and it gets reopened?

    22. gvanrossum
      closed this as completedon Jul 23, 2022
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

    Metadata

    Metadata

    Assignees

    No one assigned

      Labels

      3.10 (EOL)end of life3.7 (EOL)end of life3.8 (EOL)end of life3.9 (EOL)end of lifetestsTests in the Lib/test dirtype-securityA security issue

      Projects

      No projects

        Milestone

        No milestone

        Relationships

        None yet

        Development

        No branches or pull requests

        Issue actions