FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

gh-114539: Clarify implicit launching of shells by subprocess by zooba · Pull Request #117996 · python/cpython · GitHub

/ cpython Public

gh-114539: Clarify implicit launching of shells by subprocess - #117996

Merged
zooba merged 2 commits into
python:mainfrom
zooba:gh-114539
Apr 17, 2024
ConversationCommits (2)ChecksFiles changed
Merged

gh-114539: Clarify implicit launching of shells by subprocess#117996
zooba merged 2 commits into
python:mainfrom
zooba:gh-114539

Conversation

zooba commented Apr 17, 2024 •
edited by github-actions Bot
Loading

Copy link
Copy Markdown
Member

This is the same issue as recently disclosed by Rust (CVE-2024-24576), but as it is intentional operating system behaviour, we consider it to not be a Python vulnerability. If an attacker can influence the executable argument and other arguments, no reasonable validation can detect this case (without actually launching the executable and seeing what happens), and the app is exploitable already.

Rust was already detecting whether the executable was a batch file and changing their behaviour, which is why they chose to apply a fix. Python does no such detection, but relies exclusively on the shell argument.

📚 Documentation preview 📚: https://cpython-previews--117996.org.readthedocs.build/

zooba added docs Documentation in the Doc dir type-security A security issue needs backport to 3.8 needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes labels Apr 17, 2024
bedevere-app Bot mentioned this pull request Apr 17, 2024
Closed
sethmlarson approved these changes Apr 17, 2024
View reviewed changes

sethmlarson left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

Thanks Steve! LGTM

zooba merged commit a4b44d3 into python:main Apr 17, 2024

miss-islington-app Bot commented Apr 17, 2024

Copy link
Copy Markdown

Thanks @zooba for the PR 🌮🎉.. I'm working now to backport this PR to: 3.8, 3.9, 3.10, 3.11, 3.12.
🐍🍒⛏🤖

zooba deleted the gh-114539 branch April 17, 2024 18:32
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Apr 17, 2024
pythongh-114539: Clarify implicit launching of shells by subprocess (p…
b7f8c77 
…ythonGH-117996)

(cherry picked from commit a4b44d3)

Co-authored-by: Steve Dower <steve.dower@python.org>

bedevere-app Bot commented Apr 17, 2024

Copy link
Copy Markdown

GH-118002 is a backport of this pull request to the 3.12 branch.

bedevere-app Bot removed the needs backport to 3.12 only security fixes label Apr 17, 2024
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Apr 17, 2024
pythongh-114539: Clarify implicit launching of shells by subprocess (p…
085ad6a 
…ythonGH-117996)

(cherry picked from commit a4b44d3)

Co-authored-by: Steve Dower <steve.dower@python.org>

bedevere-app Bot commented Apr 17, 2024

Copy link
Copy Markdown

GH-118003 is a backport of this pull request to the 3.11 branch.

bedevere-app Bot removed the needs backport to 3.11 only security fixes label Apr 17, 2024
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Apr 17, 2024
pythongh-114539: Clarify implicit launching of shells by subprocess (p…
f03a28f 
…ythonGH-117996)

(cherry picked from commit a4b44d3)

Co-authored-by: Steve Dower <steve.dower@python.org>

bedevere-app Bot commented Apr 17, 2024

Copy link
Copy Markdown

GH-118004 is a backport of this pull request to the 3.10 branch.

bedevere-app Bot removed the needs backport to 3.10 only security fixes label Apr 17, 2024
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Apr 17, 2024
pythongh-114539: Clarify implicit launching of shells by subprocess (p…
3fc8a8b 
…ythonGH-117996)

(cherry picked from commit a4b44d3)

Co-authored-by: Steve Dower <steve.dower@python.org>

bedevere-app Bot commented Apr 17, 2024

Copy link
Copy Markdown

GH-118005 is a backport of this pull request to the 3.9 branch.

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Apr 17, 2024
pythongh-114539: Clarify implicit launching of shells by subprocess (p…
89632e6 
…ythonGH-117996)

(cherry picked from commit a4b44d3)

Co-authored-by: Steve Dower <steve.dower@python.org>

bedevere-app Bot commented Apr 17, 2024

Copy link
Copy Markdown

GH-118006 is a backport of this pull request to the 3.8 branch.

zooba added a commit that referenced this pull request Apr 17, 2024
[3.12] gh-114539: Clarify implicit launching of shells by subprocess (G…
859fdee 
…H-117996) (#118002)

gh-114539: Clarify implicit launching of shells by subprocess (GH-117996)
(cherry picked from commit a4b44d3)

Co-authored-by: Steve Dower <steve.dower@python.org>
ambv pushed a commit that referenced this pull request May 7, 2024
[3.10] gh-114539: Clarify implicit launching of shells by subprocess (G…
9b33629 
…H-117996) (GH-118004)

(cherry picked from commit a4b44d3)

Co-authored-by: Steve Dower <steve.dower@python.org>
ambv pushed a commit that referenced this pull request May 7, 2024
[3.9] gh-114539: Clarify implicit launching of shells by subprocess (G…
22ae383 
…H-117996) (GH-118005)

(cherry picked from commit a4b44d3)

Co-authored-by: Steve Dower <steve.dower@python.org>
ambv pushed a commit that referenced this pull request May 7, 2024
[3.8] gh-114539: Clarify implicit launching of shells by subprocess (G…
14ac620 
…H-117996) (GH-118006)

(cherry picked from commit a4b44d3)

Co-authored-by: Steve Dower <steve.dower@python.org>
hugovk pushed a commit that referenced this pull request Aug 9, 2024
[3.11] gh-114539: Clarify implicit launching of shells by subprocess (G…
b396360 
…H-117996) (#118003)

Co-authored-by: Steve Dower <steve.dower@python.org>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

gpshead gpshead approved these changes
sethmlarson sethmlarson approved these changes

Assignees

No one assigned

Labels

docs Documentation in the Doc dir skip news type-security A security issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

Back | FazBrowse Home | New Git URL