]> git.ipfire.org Git - thirdparty/Python/cpython.git/commit
projects / thirdparty / Python / cpython.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 24ba0ea) | patch
bpo-42988: Remove the pydoc getfile feature (GH-25015)
authorMiss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Mon, 29 Mar 2021 13:02:40 +0000 (06:02 -0700)
committerGitHub <noreply@github.com>
Mon, 29 Mar 2021 13:02:40 +0000 (06:02 -0700)
commit7e38d3309e0a5a7b9e23ef933aef0079c6e317f7
tree915f06cf5c934914d3c13f287697602c0de5da14tree | snapshot
parent24ba0ea9e0160cc85e0fa24f32b1651c8b3a24b0commit | diff
bpo-42988: Remove the pydoc getfile feature (GH-25015)

CVE-2021-3426: Remove the "getfile" feature of the pydoc module which
could be abused to read arbitrary files on the disk (directory
traversal vulnerability). Moreover, even source code of Python
modules can contain sensitive data like passwords. Vulnerability
reported by David Schwörer.
(cherry picked from commit 9b999479c0022edfc9835a8a1f06e046f3881048)

Co-authored-by: Victor Stinner <vstinner@python.org>
Lib/pydoc.py diff | blob | blame | history
Lib/test/test_pydoc.py diff | blob | blame | history
Misc/NEWS.d/next/Security/2021-03-24-14-16-56.bpo-42988.P2aNco.rst [new file with mode: 0644] blob
Mirror of https://github.com/python/cpython.git