CVE-2024-3220

Description

There is a defect in the CPython standard library module “mimetypes” where on Windows the default list of known file locations are writable meaning other users can create invalid files to cause MemoryError to be raised on Python runtime startup or have file extensions be interpreted as the incorrect file type. This defect is caused by the default locations of Linux and macOS platforms (such as “/etc/mime.types”) also being used on Windows, where they are user-writable locations (“C:\etc\mime.types”). To work-around this issue a user can call mimetypes.init() with an empty list (“[]”) on Windows platforms to avoid using the default list of known file locations.

References

https://security.netapp.com/advisory/ntap-20250314-0001/

https://mail.python.org/archives/list/[email protected]/thread/CDXW34ND2LSAOYAR5N6UNONP4ZBX4D6R/

https://github.com/python/cpython/issues/159428

https://github.com/python/cpython/commit/8d4286a3f41d36f42c4b4cf5c4451a5a8c23fe87

https://github.com/python/cpython/commit/76f4555c4ff10f5dda58d6528c17787df41e256c

https://github.com/python/cpython/commit/5550519259656cbb8eeac09e3dbc0d5c248a4dea

https://github.com/python/cpython/commit/35dd324f6e30735162a68cde84bb04a169004325

https://github.com/python/cpython/commit/2f00690fd5a75305e02c99628a41439179266f29

https://github.com/python/cpython/commit/04a29bf8f9ff8526cd96cb7368400173303a390a

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-31812

http://www.openwall.com/lists/oss-security/2025/02/14/8

Details

Source: Mitre, NVD

Named Vulnerability: GHSA-74p9-4v44-wwx5

Risk Information

CVSS v2

CVSS v3

CVSS v4

EPSS