New submission from Serhiy Storchaka: It is possible to inject an environment variable in subprocess on Windows if a user data is passed to a subprocess via environment variable.
Provided PR fixes this vulnerability. It also adds other checks for invalid environment (variable names containing '=') and command arguments (containing '\0'). This was a part of issue13617, but extracted to a separate issue due to increased severity. ---------- components: Extension Modules messages: 296618 nosy: paul.moore, serhiy.storchaka, steve.dower, tim.golden, zach.ware priority: normal severity: normal stage: patch review status: open title: Injecting environment variable in subprocess on Windows type: security versions: Python 2.7, Python 3.5, Python 3.6, Python 3.7 _______________________________________ Python tracker <rep...@bugs.python.org> <http://bugs.python.org/issue30730> _______________________________________ _______________________________________________ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
