CVE-2025-6075
⚪ Do wiadomości
Wykorzystanie os.path.expandvars() z kontrolowanym przez użytkownika wejściem może prowadzić do spadku wydajności.
CVSS
5.5
EPSS
0.1%
Exploit
none
Vendor
python
Opis źródłowy (NVD)
If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.
brak
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 5.5 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 0.1% |
| Opublikowano (NVD) | 2025-10-31 17:15:48 UTC |
| Ostatnia modyfikacja (NVD) | 2026-09-30 23:10:00 UTC |
Referencje
- https://github.com/python/cpython/commit/2e6150adccaaf5bd95d4c19dfd04a36e0b325d8c ([email protected]) [Patch]
- https://github.com/python/cpython/commit/5dceb93486176e6b4a6d9754491005113eb23427 ([email protected]) [Patch]
- https://github.com/python/cpython/commit/631ba3407e3348ccd56ce5160c4fb2c5dc5f4d84 ([email protected]) [Patch]
- https://github.com/python/cpython/commit/892747b4cf0f95ba8beb51c0d0658bfaa381ebca ([email protected]) [Patch]
- https://github.com/python/cpython/commit/9ab89c026aa9611c4b0b67c288b8303a480fe742 ([email protected]) [Patch]
- https://github.com/python/cpython/commit/c8a5f3435c342964e0a432cc9fb448b7dbecd1ba ([email protected]) [Patch]
- https://github.com/python/cpython/commit/f029e8db626ddc6e3a3beea4eff511a71aaceb5c ([email protected]) [Patch]
- https://github.com/python/cpython/issues/136065 ([email protected]) [Issue Tracking, Vendor Advisory]
- https://mail.python.org/archives/list/[email protected]/thread/IUP5QJ6D4KK6ULHOMPC7DPNKRYQTQNLA/ ([email protected]) [Third Party Advisory]