CVE-2024-3220

一、漏洞信息
 漏洞编号：[CVE-2024-3220](https://nvd.nist.gov/vuln/detail/CVE-2024-3220)
 漏洞归属组件：[python3](https://gitee.com/src-openeuler/python3)
 漏洞归属的版本：3.10.2,3.10.9,3.11.11,3.11.4,3.11.6,3.7.9,3.8.5,3.9.9
 CVSS V3.0分值：
  BaseScore：4.6 Medium
  Vector：CVSS：3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
 漏洞简述：
  There is a defect in the CPython standard library module “mimetypes” where on Windows the default list of known file locations are writable meaning other users can create invalid files to cause MemoryError to be raised on Python runtime startup or have file extensions be interpreted as the incorrect file type.This defect is caused by the default locations of Linux and macOS platforms (such as “/etc/mime.types”) also being used on Windows, where they are user-writable locations (“C: etc mime.types”).To work-around this issue a user can call mimetypes.init() with an empty list (“[]”) on Windows platforms to avoid using the default list of known file locations.
 漏洞公开时间：2025-02-15 01:15:15
 漏洞创建时间：2025-02-15 03:44:15
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-3220
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| cna.python.org | https://mail.python.org/archives/list/security-announce@python.org/thread/CDXW34ND2LSAOYAR5N6UNONP4ZBX4D6R/ |  |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.openwall.com/lists/oss-security/2025/02/14/8 |  |
| af854a3a-2127-422b-91ae-364da2661108 | https://security.netapp.com/advisory/ntap-20250314-0001/ |  |
| suse_bugzilla | https://mail.python.org/mailman3/lists/security-announce.python.org/ | https://bugzilla.suse.com/show_bug.cgi?id=1241914 |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-3220 | https://bugzilla.suse.com/show_bug.cgi?id=1241914 |
| suse_bugzilla | https://seclists.org/oss-sec/2025/q1/138 | https://bugzilla.suse.com/show_bug.cgi?id=1241914 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-3220 | https://bugzilla.suse.com/show_bug.cgi?id=1241914 |
| suse_bugzilla | https://mail.python.org/archives/list/security-announce@python.org/thread/CDXW34ND2LSAOYAR5N6UNONP4ZBX4D6R/ | https://bugzilla.suse.com/show_bug.cgi?id=1241914 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2345794 | https://bugzilla.suse.com/show_bug.cgi?id=1241914 |
| suse_bugzilla | http://www.openwall.com/lists/oss-security/2025/02/14/8 | https://bugzilla.suse.com/show_bug.cgi?id=1241914 |
| suse_bugzilla | https://github.com/CVEProject/cvelistV5/blob/main//cves/2024/3xxx/CVE-2024-3220.json | https://bugzilla.suse.com/show_bug.cgi?id=1241914 |
| suse_bugzilla | https://security.netapp.com/advisory/ntap-20250314-0001/ | https://bugzilla.suse.com/show_bug.cgi?id=1241914 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-3220 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

无
</details>

二、漏洞分析结构反馈
 影响性分析说明：
  CPython 标准库模块“mimetypes”存在一个缺陷，在 Windows 上，已知文件位置的默认列表是可写的，这意味着其他用户可以创建无效文件，导致 Python 运行时启动时引发 MemoryError，或者将文件扩展名解释为错误的文件类型。此缺陷是由 Linux 和 macOS 平台的默认位置（例如“/etc/mime.types”）也在 Windows 上使用引起的，这些位置是用户可写的（“C: etc mime.types”）。要解决此问题，用户可以在 Windows 平台上调用 mimetypes.init() 并传递一个空列表（“【】”），以避免使用已知文件位置的默认列表。
 openEuler评分：
  4.6
 Vector：CVSS：3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
 受影响版本排查(受影响/不受影响)：
  1.master(3.11.11):受影响
2.openEuler-20.03-LTS-SP4(3.7.9):受影响
3.openEuler-22.03-LTS-SP3(3.9.9):受影响
4.openEuler-22.03-LTS-SP4(3.9.9):受影响
5.openEuler-24.03-LTS:受影响
6.openEuler-24.03-LTS-Next:受影响
7.openEuler-24.03-LTS-SP1:受影响
8.openEuler-24.03-LTS-SP2:受影响

修复是否涉及abi变化(是/否)：
  1.master(3.11.11):否
2.openEuler-20.03-LTS-SP4(3.7.9):否
3.openEuler-22.03-LTS-SP3(3.9.9):否
4.openEuler-22.03-LTS-SP4(3.9.9):否
5.openEuler-24.03-LTS:否
6.openEuler-24.03-LTS-Next:否
7.openEuler-24.03-LTS-SP1:否
8.openEuler-24.03-LTS-SP2:否

原因说明：
  1.master(3.11.11):暂不修复-暂无解决方案或补丁
2.openEuler-20.03-LTS-SP4(3.7.9):暂不修复-暂无解决方案或补丁
3.openEuler-22.03-LTS-SP3(3.9.9):暂不修复-暂无解决方案或补丁
4.openEuler-22.03-LTS-SP4(3.9.9):暂不修复-暂无解决方案或补丁
5.openEuler-24.03-LTS:暂不修复-暂无解决方案或补丁
6.openEuler-24.03-LTS-Next:暂不修复-暂无解决方案或补丁
7.openEuler-24.03-LTS-SP1:暂不修复-暂无解决方案或补丁
8.openEuler-24.03-LTS-SP2:暂不修复-暂无解决方案或补丁

src-openEuler/python3

Content Risk Flag

Comments (5)

src-openEuler/python3 .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-3220

Comments (5)

Search

src-openEuler/python3