CVE-2024-3220

描述

There is a defect in the CPython standard library module “mimetypes” where on Windows the default list of known file locations are writable meaning other users can create invalid files to cause MemoryError to be raised on Python runtime startup or have file extensions be interpreted as the incorrect file type.This defect is caused by the default locations of Linux and macOS platforms (such as “/etc/mime.types”) also being used on Windows, where they are user-writable locations (“C:\etc\mime.types”).To work-around this issue a user can call mimetypes.init() with an empty list (“[]”) on Windows platforms to avoid using the default list of known file locations.

如何修補 CVE-2024-3220

要修補 CVE-2024-3220,請將受影響套件升級到下列已修補版本。

• —升級至 3.14.0 或更新版本
• —升級至 3.14.0 或更新版本

CVE-2024-3220 正在被利用嗎?

低 — EPSS 為 0.5%,目前沒有觀察到大規模利用活動。

受影響套件(2)

• from 0, < 3.14.0
• from 0, < 3.14.0

參考連結(2)

• WEBwww.openwall.com/lists/oss-security/2025/02/14/8
• WEBmail.python.org/archives/list/security-announce@python.org/thread/CDXW34ND2LSAOYAR5N6UNONP4ZBX4D6R/