Path Truncation Vulnerability in Python 3.11 - CVE-2023-41105
Summary
UBUNTU-CVE-2023-41105: An issue was discovered in Python 3.11 through 3.11.4. Affects python3.11 versions 3.11.0~rc1-1~22.04. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.11 is a widely used programming language known for its simplicity and versatility in various applications, including web development, data analysis, and automation. This version introduced several enhancements and features, but it also introduced a vulnerability that affects how paths containing null bytes ('\0') are handled, potentially leading to unexpected behavior in applications relying on file path validation.
Vulnerability Detail
An issue was discovered in Python 3.11 through 3.11.4 where passing a path containing '\0' bytes to os.path.normpath() results in the path being truncated at the first '\0' byte. This change in behavior from Python 3.10.x and earlier versions can lead to security vulnerabilities, as applications may accept filenames that should have been rejected, potentially allowing unauthorized access or manipulation of files.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using paths that contain null bytes ('\0') in your applications. Implement additional validation checks in your code to reject such filenames before passing them to os.path.normpath().
Conclusion
CVE-2023-41105 presents a significant security risk in Python 3.11 due to its handling of paths with null bytes. It is crucial to update to the patched version to ensure the security of applications using this version of Python. Implementing workarounds can help mitigate risks until an update can be applied.
See every vulnerability recorded for python3.11 →
FAQ
CVE-2023-41105 is a vulnerability in Python 3.11 that allows paths containing null bytes to be truncated, potentially leading to security issues.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to files and manipulation of file paths that should have been rejected, leading to potential security breaches.
Yes, a patched version of Python 3.11 is available. Update to version 3.11.0~rc1-1~22.04.1~esm1 to mitigate the vulnerability.
If you cannot update immediately, implement additional validation checks in your code to reject filenames containing null bytes.
Related vulnerabilities
Recent vulnerabilities recorded for python3.11.
