[CVE-2020-15801] python 38 embed ignore python38._pth file on windows

[jgiardet]

BPO	41304
Nosy	@pfmoore, @tjguk, @ned-deily, @zware, @zooba, @miss-islington, @jgiardet
PRs	bpo-41304: Ensure python3x._pth is loaded on Windows #21495 [3.9] bpo-41304: Ensure python3x._pth is loaded on Windows (GH-21495) #21497 [3.8] bpo-41304: Ensure python3x._pth is loaded on Windows (GH-21495) #21498 [3.7] bpo-41304: Ensure python3x._pth is loaded on Windows (GH-21495) #21499 bpo-41304: Update NEWS to include CVE-2020-15801 reference #21521 [3.9] bpo-41304: Update NEWS to include CVE-2020-15801 reference (GH-21521) #21522 [3.7] bpo-41304: Update NEWS to include CVE-2020-15801 reference (GH-21521) #21524 [3.8] bpo-41304: Update NEWS to include CVE-2020-15801 reference (GH-21521) #21523

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2020-07-16.17:08:16.246>
created_at = <Date 2020-07-15.14:41:17.913>
labels = ['type-security', 'interpreter-core', '3.8', '3.9', '3.10', '3.7', 'OS-windows']
title = '[CVE-2020-15801] python 38 embed ignore python38._pth file on windows'
updated_at = <Date 2020-08-06.16:10:28.228>
user = 'https://github.com/jgiardet'

bugs.python.org fields:

activity = <Date 2020-08-06.16:10:28.228>
actor = 'steve.dower'
assignee = 'none'
closed = True
closed_date = <Date 2020-07-16.17:08:16.246>
closer = 'steve.dower'
components = ['Interpreter Core', 'Windows']
creation = <Date 2020-07-15.14:41:17.913>
creator = 'jgirardet'
dependencies = []
files = []
hgrepos = []
issue_num = 41304
keywords = ['patch', '3.8regression']
message_count = 14.0
messages = ['373698', '373701', '373706', '373727', '373728', '373729', '373731', '373756', '373836', '373837', '373838', '373891', '374912', '374942']
nosy_count = 8.0
nosy_names = ['paul.moore', 'tim.golden', 'ned.deily', 'zach.ware', 'steve.dower', 'miss-islington', 'jgirardet', 'owen.huang']
pr_nums = ['21495', '21497', '21498', '21499', '21521', '21522', '21524', '21523']
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue41304'
versions = ['Python 3.7', 'Python 3.8', 'Python 3.9', 'Python 3.10']

[jgiardet]

Hi,
With python embed unziped in 38 directory(python 3.8.4):

# python38._pth
python38.zip
.
..\\app
# Uncomment to run site.main() automatically
#import site

PS C:\Users\jimmy\rien\embed> .\38\python.exe -c "import sys;print(sys.path);import hello"
['', 'C:\\Users\\jimmy\\rien\\embed\\38\\python38.zip', 'C:\\Users\\jimmy\\rien\\embed\\38\\DLLs', 'C:\\Users\\jimmy\\ri
en\\embed\\38\\lib', 'C:\\Users\\jimmy\\rien\\embed\\38']
Traceback (most recent call last):
  File "<string>", line 1, in <module>
ModuleNotFoundError: No module named 'hello'


'\\app' is not added to sys.path. it is under python 3.

Note It's working under python 3.7.8

[jgiardet]

replacing python38._pth by python._pth does fix it.

[zooba]

Thanks, this is a regression.

https://github.com/python/cpython/blob/master/PC/getpathp.c#L672 should be inverted, as a zero return value indicates success.

[zooba]

New changeset 936a660 by Steve Dower in branch 'master':
bpo-41304: Ensure python3x._pth is loaded on Windows (GH-21495)
936a660

[miss-islington]

New changeset 28e93dd by Miss Islington (bot) in branch '3.9':
bpo-41304: Ensure python3x._pth is loaded on Windows (GH-21495)
28e93dd

[miss-islington]

New changeset 3b6a8d2 by Miss Islington (bot) in branch '3.8':
bpo-41304: Ensure python3x._pth is loaded on Windows (GH-21495)
3b6a8d2

[ned-deily]

New changeset 4bfcffe by Steve Dower in branch '3.7':
bpo-41304: Ensure python3x._pth is loaded on Windows (GH-21495) (bpo-21499)
4bfcffe

[zooba]

For clarity, this was caused by the fix for bpo-29778, and was only released in 3.8.4 and 3.9.0b4. No other versions had a release before the fix was merged.

[zooba]

This is now assigned CVE-2020-15801

[zooba]

New changeset a16ac4e by Miss Islington (bot) in branch '3.9':
bpo-41304: Update NEWS to include CVE-2020-15801 reference (GH-21521)
a16ac4e

[zooba]

New changeset 79ed1a5 by Miss Islington (bot) in branch '3.8':
bpo-41304: Update NEWS to include CVE-2020-15801 reference (GH-21521)
79ed1a5

[ned-deily]

New changeset eb0d255 by Miss Islington (bot) in branch '3.7':
bpo-41304: Update NEWS to include CVE-2020-15801 reference (GH-21521) (GH-21524)
eb0d255

[owenhuang]

hi, since the affected system is not clearly stated on the NVD, I'd like to confirm with you that:

Does the CVE-2020-15801 vulnerability affect only the Windows OS?

thanks a lot!

[zooba]

Yes, it only affects Windows OS.

On all other platforms, the python38._pth file is _always_ ignored. We have not implemented this support for those platforms.