提交CVE-2023-41105 · Pull Request !473 · openKylin/openkylin-exploit-db

### 相关的Issue
Multiple NetApp products incorporate Python. Python versions prior to 3.11 through 3.11.4 are susceptible to a vulnerability which when successfully exploited could lead to addition or modification of data.

### 原因（目的、解决的问题等）
Passing a path with null bytes to the os.path.normpath() function causes the returned path to be unexpectedly truncated at the first occurrence of null bytes within the path. Python versions before 3.11.0 didn’t truncate the path on null bytes.

If allowlisting is applied before a call to os.path.normpath() is used later in the program, the allowlisting can be circumvented if the path containing null bytes is constructed to pass the allowlist but then change to the targeted resource after truncation.

### 描述（做了什么，变更了什么）
An issue was discovered in Python 3.11 through 3.11.4. If a path containing \0 bytes is passed to os.path.normpath(), the path will be truncated unexpectedly at the first \0 byte. There are plausible cases in which an application would have rejected a filename for security reasons in Python 3.10.x or earlier, but that filename is no longer rejected in Python 3.11.x.

### 测试用例（新增、改动、可能影响的功能）

Python 3.10:
import os.path
os.path.normpath('hello\x00world')
os.path.normpath('\x00hello')

Python 3.11:
import os.path
os.path.normpath('hello\x00world')
os.path.normpath('\x00hello')

类型	指派人员	状态
审查	LI, WENJIE 已审查通过 Re3et	已完成 (1/1人)
测试	LI, WENJIE 已测试通过 Set3r.Pan 已测试通过宋帮诚晋已测试通过 Re3et 已测试通过	已完成 (4/1人)

openKylin/openkylin-exploit-db .gitee-modal { width: 500px !important; }

搜索帮助

openKylin/openkylin-exploit-db