Описание
When using the "configparser" module to write configuration files
containing multi-line text values with carriage return characters (\r) the
resulting file could be injected with unexpected keys and values if the
attacker controls the written value.
A flaw was found in the Python configparser module. When writing configuration files, an attacker who controls the input value can inject unexpected keys and values. This occurs if the input contains multi-line text with carriage return characters, leading to potential configuration manipulation.
Отчет
This flaw in the Python configparser module allows for configuration injection. When an application utilizes configparser to write multi-line input containing carriage return characters that are controlled by an attacker, arbitrary keys and values can be injected into the configuration file. This risk is present only in applications that process and write untrusted multi-line input directly to configuration files.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Exploit Intelligence | exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 | Fix deferred | ||
| Red Hat Enterprise Linux 10 | python3.12 | Fix deferred | ||
| Red Hat Enterprise Linux 10 | python3.14 | Not affected | ||
| Red Hat Enterprise Linux 6 | python | Fix deferred | ||
| Red Hat Enterprise Linux 7 | python | Fix deferred | ||
| Red Hat Enterprise Linux 7 | python3 | Fix deferred | ||
| Red Hat Enterprise Linux 8 | python3 | Fix deferred | ||
| Red Hat Enterprise Linux 8 | python3.12 | Not affected | ||
| Red Hat Enterprise Linux 8 | python36 | Fix deferred | ||
| Red Hat Enterprise Linux 9 | python3.12 | Fix deferred |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.
When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.
When using the "configparser" module to write configuration files cont ...
EPSS
5.5 Medium
CVSS3