CVE-2020-8315: Unsafe DLL loading in getpathp.c on Windows 7

2020-01-2818:35:58

Google

osv.dev

6.6 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

20.9%

JSON

In Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an insecure dependency load upon launch on Windows 7 may result in an attacker’s copy of api-ms-win-core-path-l1-1-0.dll being loaded and used instead of the system’s copy. Windows 8 and later are unaffected.

CPENameOperatorVersion
cpythoneq1.0.2
cpythoneq3.1.2rc1
cpythoneq3.3.5
cpythoneq2.7b1
cpythoneq1.5b2
cpythoneq3.3.0b2
cpythoneq3.6.0a3
cpythoneq3.2.1rc2
cpythoneq2.1c1
cpythoneq3.8.0a4

Name	Operator	Version
cpython	eq	1.0.2
cpython	eq	3.1.2rc1
cpython	eq	3.3.5
cpython	eq	2.7b1
cpython	eq	1.5b2
cpython	eq	3.3.0b2
cpython	eq	3.6.0a3
cpython	eq	3.2.1rc2
cpython	eq	2.1c1
cpython	eq	3.8.0a4