^{CVE-2020-27619:}Python 3 through 3.9.0 contains a vulnerability where CJK codec tests execute eval() on HTTP-retrieved content.

Overview

This vulnerability affects Python 3 through 3.9.0 and is located in the test suite for multibyte character encodings. The specific issue is in the CJK codec tests which use eval() to process content retrieved from HTTP sources. The eval() function is dangerous when used on untrusted input as it can execute arbitrary Python code. In this case, if an attacker can control the HTTP response content during testing, they could potentially execute malicious code with the privileges of the Python process.

While this vulnerability is limited to the test suite and not the core functionality of Python, it still represents a security risk in environments where the tests might be run, especially in automated testing pipelines or development environments.

Remediation

To remediate this vulnerability, users should:

1. Update to Python 3.9.1 or later versions where this issue has been patched.
2. If updating is not immediately possible, avoid running the affected tests in untrusted network environments.
3. Consider implementing network controls to prevent unauthorized access to HTTP traffic during test execution.
4. For system administrators managing Python installations, ensure that the test suite is not accessible to unprivileged users.

The Python development team has addressed this issue with several patches that modify how the tests handle external content, replacing the unsafe eval() calls with safer alternatives.

References

1. Python Bug Tracker: https://bugs.python.org/issue41944
2. Fix Commits:
   • https://github.com/python/cpython/commit/2ef5caa58febc8968e670e39e3d37cf8eef3cab8
   • https://github.com/python/cpython/commit/43e523103886af66d6c27cd72431b5d9d14cd2a9
   • https://github.com/python/cpython/commit/6c6c256df3636ff6f6136820afaefa5a10a3ac33
   • https://github.com/python/cpython/commit/b664a1df4ee71d3760ab937653b10997081b1794
   • https://github.com/python/cpython/commit/e912e945f2960029d039d3390ea08835ad39374b
3. NetApp Security Advisory: https://security.netapp.com/advisory/ntap-20201123-0004/
4. Oracle Critical Patch Update: https://www.oracle.com/security-alerts/cpujul2022.html
5. Fedora Security Announcements:
   • https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
   • https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
6. Gentoo Linux Security Advisory: https://security.gentoo.org/glsa/202402-04