Python: Schwachstelle ermöglicht Codeausführung
WID-SEC-2022-0253 · first 14.04.2022 · updated 10.07.2026 · CVSS 9,8
What it is about
Python ist eine universelle, üblicherweise interpretierte, höhere Programmiersprache. Ein Angreifer kann eine Schwachstelle in Python ausnutzen, um beliebigen Programmcode auszuführen.
Under what conditions?
The BSI does not name any particular preconditions. Exploitable remotely according to the BSI.
What can happen in the worst case
An attacker could use the vulnerability to
- beliebigen Programmcode auszuführen
Am I affected?
Affected according to the BSI:
- Open Source Python <=3.10.4
- Debian Linux
- Red Hat Enterprise Linux
- Fedora Linux
- Ubuntu Linux
- SUSE Linux
- Oracle Linux
- Red Hat OpenShift
- EMC Avamar
- NetApp ActiveIQ Unified Manager
- IBM SPSS Modeler
- IBM QRadar SIEM 7.5
and 1 more
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Update to at least:
- Open Source Python <=3.10.4
Is the vulnerability already being exploited?
None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.
Information and sources
- Original BSI advisory (WID)
- National Vulnerability Database vom 2022-04-13 nvd.nist.gov
- NetApp Security Advisory NTAP-20220616-0001 vom 2022-06-16 security.netapp.com
- SUSE Security Update SUSE-SU-2022:2147-1 vom 2022-06-21 lists.suse.com
- SUSE Security Update SUSE-SU-2022:2166-1 vom 2022-06-23 lists.suse.com
- SUSE Security Update SUSE-SU-2022:2174-1 vom 2022-06-24 lists.suse.com
- SUSE Security Update SUSE-SU-2022:2249-1 vom 2022-07-04 lists.suse.com
- SUSE Security Update SUSE-SU-2022:2291-1 vom 2022-07-06 lists.suse.com
- SUSE Security Update SUSE-SU-2022:2344-1 vom 2022-07-08 lists.suse.com
- SUSE Security Update SUSE-SU-2022:2351-1 vom 2022-07-11 lists.suse.com
- SUSE Security Update SUSE-SU-2022:2357-1 vom 2022-07-12 lists.suse.com
- Ubuntu Security Notice USN-5519-1 vom 2022-07-14 ubuntu.com
- SUSE Security Update SUSE-SU-2022:2357-2 vom 2022-09-01 lists.suse.com
- Oracle Linux Security Advisory ELSA-2022-6457 vom 2022-09-14 linux.oracle.com
- Red Hat Security Advisory RHSA-2022:6457 vom 2022-09-13 access.redhat.com
- Red Hat Security Advisory RHSA-2022:6537 vom 2022-09-20 access.redhat.com
- Red Hat Security Advisory RHSA-2022:6766 vom 2022-10-03 access.redhat.com
- Red Hat Security Advisory RHSA-2022:7055 vom 2022-10-19 access.redhat.com
- Red Hat Security Advisory RHSA-2022:7058 vom 2022-10-20 access.redhat.com
- Red Hat Security Advisory RHSA-2022:7581 vom 2022-11-08 access.redhat.com
- Red Hat Security Advisory RHSA-2022:7592 vom 2022-11-08 access.redhat.com
- Red Hat Security Advisory RHSA-2022:7593 vom 2022-11-08 access.redhat.com
- Oracle Linux Security Advisory ELSA-2022-7581 vom 2022-11-15 linux.oracle.com
- Red Hat Security Advisory RHSA-2022:8353 vom 2022-11-15 access.redhat.com
- Ubuntu Security Notice USN-5888-1 vom 2023-02-28 ubuntu.com
- SUSE Security Update SUSE-SU-2023:0707-1 vom 2023-03-10 lists.suse.com
and 10 more sources in the original advisory
CVE: CVE-2015-20107
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.