Insecure Dependency Load in Python (CPython) 3.6 through 3.8
Summary
CVE-2020-8315: In Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an insecure dependency load upon launch on Windows 7 may result in an attacker's copy of api-ms-win-core-path-l1-1-0.dll being loaded and... Affects python3 across 4 version ranges.
>= 1bf9cc509326bc42cd8cb1650eb9bf64550d817e, <= 43364a7ae01fbe4288ef42622259a0038ce1edcc
< 3.7.7-r0
>= 5c4568a05a0a62b5947c55f68f9f2ecfb90a4f12, <= 02dff8b01100e7cd6d4c93be27202ccb4ea05811
>= fa919fdf2583bdfead1df00e842f24f30b2a34bf, <= 1b293b60067f6f4a95984d064ce0f6b6d34c1216
Fixed in 3.7.7-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a popular programming language known for its simplicity and versatility. CPython is the reference implementation of Python, and it is widely used by developers. This vulnerability affects CPython versions 3.6 through 3.8 on Windows 7. The vulnerability arises from an insecure dependency load during launch, which may result in an attacker's copy of api-ms-win-core-path-l1-1-0.dll being loaded instead of the system's copy. This issue does not affect Windows 8 and later versions.
Vulnerability Detail
The insecure dependency load in CPython 3.6 through 3.8 on Windows 7 can lead to the execution of malicious code by loading an attacker's copy of api-ms-win-core-path-l1-1-0.dll. This can potentially allow an attacker to gain unauthorized access, perform arbitrary actions, or compromise the system. The vulnerability has a CVSS score of 5.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
3.7.7-r0
This is the first release that contains the fix.
sudo apk add --upgrade python3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to follow the recommended fix and update to a patched version of CPython.
Conclusion
Insecure dependency load in CPython 3.6 through 3.8 on Windows 7 can lead to the execution of malicious code. It is crucial to update to a fixed version of CPython, such as 3.7.7 or later, or 3.8.2 or later, to mitigate this vulnerability. Regularly updating the Python installation is recommended to ensure the latest security patches are applied. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python3 →
FAQ
CPython is the reference implementation of Python, which is widely used by developers.
CPython versions 3.6 through 3.8 on Windows 7 are affected.
The vulnerability can allow an attacker to execute malicious code and potentially gain unauthorized access or compromise the system.
No, this vulnerability only affects Windows 7.
The CVSS score of this vulnerability is 5.5, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for python3.
