Critical Vulnerability in Python Packages: CVE-2020-27619
Summary
UBUNTU-CVE-2020-27619: In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP. Affects python3.4 versions < 3.4.3-1ubuntu1~14.04.7+esm10. Fixed in 3.4.3-1ubuntu1~14.04.7+esm10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used high-level programming language known for its readability and versatility. It supports multiple programming paradigms and is utilized in various applications, from web development to data analysis. The affected packages, including python3.4, python3.5, python3.6, python3.7, and python3.8, are essential components of the Python ecosystem, providing core functionalities and libraries. The vulnerability identified as CVE-2020-27619 poses a significant risk to users by allowing potential code execution through malicious HTTP content.
Vulnerability Detail
CVE-2020-27619 is a critical vulnerability found in Python versions up to 3.9.0. It originates from the Lib/test/multibytecodec_support.py CJK codec tests, which improperly utilize eval() on content fetched via HTTP. This flaw can lead to arbitrary code execution, allowing attackers to execute malicious code on the user's machine. The CVSS score for this vulnerability is 9.8, indicating a high severity level, and it can have severe implications for systems relying on these Python packages.
How To Fix
Minimum fixed version
3.4.3-1ubuntu1~14.04.7+esm10
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python3.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected codec tests or restrict the execution of eval() in their applications. However, this is not a permanent solution and updating to the patched version is strongly recommended.
Conclusion
CVE-2020-27619 represents a significant security risk for users of Python packages. It is crucial to update to the patched versions to mitigate the risk of arbitrary code execution. Users should also consider using tools like Vulert to monitor their applications for vulnerabilities.
See every vulnerability recorded for python3.4 →
FAQ
CVE-2020-27619 is a critical vulnerability in Python that allows arbitrary code execution through the improper use of eval() on HTTP content.
Python versions up to 3.9.0 are affected by this vulnerability, including packages like python3.4, python3.5, python3.6, python3.7, and python3.8.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
If immediate updates are not possible, consider implementing workarounds such as avoiding the use of affected codec tests or restricting eval() execution.
The CVSS score for CVE-2020-27619 is 9.8, indicating a critical severity level.
Related vulnerabilities
Recent vulnerabilities recorded for python3.4.
