Is CVE-2015-20107 being actively exploited?

It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 7%.

What products does CVE-2015-20107 affect?

Tracked products affected include Python. Check the version you run to see whether it is affected.

How do I fix CVE-2015-20107?

Apply the vendor fix promptly. Upgrade affected products to a fixed version.

CVE-2015-20107

Q: What is CVE-2015-20107?

CVE-2015-20107 is a high-severity software vulnerability (Command injection) with a CVSS score of 7.6. In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch wit

HIGH severity · CVSS 7.6 · Command injection

7.6CVSS HIGH

Summary

In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredLow

User interactionNone

Confidentiality impactLow

Integrity impactHigh

Availability impactLow

Exploit probability (EPSS)7%

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Affected products we track (1)

Python

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

Additional information

NVD record
https://bugs.python.org/issue24778Advisory
https://github.com/python/cpython/issues/68966Advisory
https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html
https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46KWPTI72SSEOF53DOYQBQOCN4QQB2GE/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/53TQZFLS6O3FLIMVSXFEEPZSWLDZLBOX/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/57NECACX333A3BBZM2TR2VZ4ZE3UG3SN/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5DBVY4YC2P6EPZZ2DROOXHDOWZ4BJFLW/