CVE-2024-3220
LowCVSS 2.3Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
In the CPython standard library module 'mimetypes', on Windows the default list of known file locations is writable, meaning other users can create invalid files to cause MemoryError on Python runtime startup or have file extensions interpreted as the incorrect file type. This defect is caused by default locations from Linux and macOS platforms (such as '/etc/mime.types') also being used on Windows, where they are user-writable locations ('C:\etc\mime.types').
Risk Assessment
A local attacker can cause a denial of service (MemoryError at Python startup) or force incorrect file type interpretation, which may have security consequences.
Recommendation
On Windows platforms, call mimetypes.init() with an empty list ('[]') to avoid using the default list of known file locations, or update CPython to a patched version.
Other vulnerabilities in CPython
See all- CVE-2024-6232Medium
A medium severity vulnerability in CPython where regular expressions allow excessive backtracking during tarfile.TarFile header parsing, leading to ReDoS via specially crafted tar archives.
- CVE-2024-6923Medium
In CPython, the email module does not properly quote newlines in email headers during serialization, allowing header injection when an email is serialized. This is a medium severity vulnerability.
- CVE-2024-11168Medium
The urllib.parse.urlsplit() and urlparse() functions in Python improperly validate bracketed hosts (`[]`), accepting hosts that are not IPv6 or IPvFuture. This violates RFC 3986 and could enable SSRF attacks if a URL is processed by multiple URL parsers.
- CVE-2024-8088Medium
A high severity vulnerability in the CPython zipfile module affecting zipfile.Path. When iterating over entry names in a zip archive (e.g., namelist(), iterdir()), unexpected behavior may occur. The more common zipfile.ZipFile class is unaffected.
- CVE-2024-7592Low
In CPython's 'http.cookies' module, parsing cookies with backslash-escaped characters uses a quadratic algorithm, causing excessive CPU usage.
- CVE-2026-2297Medium
In CPython, the import hook handling legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and does not use io.open_code() to read the .pyc files. Consequently, sys.audit handlers for this audit event do not fire.
- CVE-2025-4516Medium
There is an issue in CPython when using `bytes.decode("unicode_escape", error="ignore|replace")`. If you are not using the "unicode_escape" encoding or an error handler, you are not affected. To work around, stop using the error= handler and wrap the bytes.decode() call in a try-except catching DecodeError.
- CVE-2024-5642Medium
CPython 3.9 and earlier does not disallow configuring an empty list ("[]") for SSLContext.set_npn_protocols(), which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used. This vulnerability is of low severity due to NPN being not widely used and specifying an empty list likely being uncommon in practice.
- CVE-2023-6507Medium
In CPython 3.12.0 in the subprocess module on POSIX platforms, when the extra_groups=[] parameter is used, the process does not call setgroups(0, NULL) before exec(), causing the new process to inherit the parent process's groups. This issue was fixed in CPython 3.12.1 and only affects processes run with root privileges.
- CVE-2015-20107High
In Python (CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9.
Original NVD description (English source)
There is a defect in the CPython standard library module “mimetypes” where on Windows the default list of known file locations are writable meaning other users can create invalid files to cause MemoryError to be raised on Python runtime startup or have file extensions be interpreted as the incorrect file type. This defect is caused by the default locations of Linux and macOS platforms (such as “/etc/mime.types”) also being used on Windows, where they are user-writable locations (“C:\etc\mime.types”). To work-around this issue a user can call mimetypes.init() with an empty list (“[]”) on Windows platforms to avoid using the default list of known file locations.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS