CVE-2017-17522

Impact:
Moderate
Public Date:
2017-12-14
CWE:
CWE-20
Bugzilla:
1526176: CVE-2017-17522 python: Command injection in Lib/webbrowser.py

The MITRE CVE dictionary describes this issue as:

** DISPUTED ** Lib/webbrowser.py in Python through 3.6.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a software maintainer indicates that exploitation is impossible because the code relies on subprocess.Popen and the default shell=False setting.

Find out more about CVE-2017-17522 from the MITRE CVE dictionary dictionary and NIST NVD.

Statement

As per upstream, "exploitation is impossible because the code relies on subprocess.Popen and the default shell=False setting". On testing it seems, upstream has correctly concluded the non-security nature of this bug.

CVSS v3 metrics

NOTE: The following CVSS v3 metrics and score provided are preliminary and subject to review.

CVSS3 Base Score 5.3
CVSS3 Base Metrics CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Attack Vector Local
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality Low
Integrity Impact Low
Availability Impact Low

Affected Packages State

Platform Package State
Red Hat Software Collections for Red Hat Enterprise Linux rh-python35-python Not affected
Red Hat Software Collections for Red Hat Enterprise Linux python27-python Not affected
Red Hat Software Collections for Red Hat Enterprise Linux rh-python34-python Not affected
Red Hat Software Collections for Red Hat Enterprise Linux rh-python36-python Not affected
Red Hat Enterprise Linux 7 python Not affected
Red Hat Enterprise Linux 6 python Not affected
Red Hat Enterprise Linux 5 python Not affected
Last Modified

CVE description copyright © 2017, The MITRE Corporation