CVE-2022-26488
Published: 10 March 2022
In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured. The installer may allow a local attacker to add user-writable directories to the system search path. To exploit, an administrator must have installed Python for all users and enabled PATH entries. A non-administrative user can trigger a repair that incorrectly adds user-writable paths into PATH, enabling search-path hijacking of other users and system services. This affects Python (CPython) through 3.7.12, 3.8.x through 3.8.12, 3.9.x through 3.9.10, and 3.10.x through 3.10.2.
Priority
Status
Package | Release | Status |
---|---|---|
python2.7 Launchpad, Ubuntu, Debian |
focal |
Not vulnerable
(windows only)
|
impish |
Not vulnerable
(windows only)
|
|
jammy |
Not vulnerable
(windows only)
|
|
upstream |
Not vulnerable
(windows only)
|
|
trusty |
Not vulnerable
(windows only)
|
|
xenial |
Not vulnerable
(windows only)
|
|
bionic |
Not vulnerable
(windows only)
|
|
python3.10 Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
impish |
Not vulnerable
(windows only)
|
|
jammy |
Not vulnerable
(windows only)
|
|
trusty |
Does not exist
|
|
upstream |
Not vulnerable
(windows only)
|
|
xenial |
Does not exist
|
|
bionic |
Does not exist
|
|
python3.4 Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
focal |
Does not exist
|
|
impish |
Does not exist
|
|
trusty |
Not vulnerable
(windows only)
|
|
upstream |
Not vulnerable
(windows only)
|
|
xenial |
Does not exist
|
|
jammy |
Does not exist
|
|
python3.5 Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
focal |
Does not exist
|
|
impish |
Does not exist
|
|
jammy |
Does not exist
|
|
trusty |
Not vulnerable
(windows only)
|
|
upstream |
Not vulnerable
(windows only)
|
|
xenial |
Not vulnerable
(windows only)
|
|
python3.6 Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(windows only)
|
focal |
Does not exist
|
|
jammy |
Does not exist
|
|
trusty |
Does not exist
|
|
xenial |
Does not exist
|
|
impish |
Does not exist
|
|
upstream |
Not vulnerable
(windows only)
|
|
python3.7 Launchpad, Ubuntu, Debian |
impish |
Does not exist
|
jammy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Not vulnerable
(windows only)
|
|
xenial |
Does not exist
|
|
bionic |
Not vulnerable
(windows only)
|
|
focal |
Does not exist
|
|
python3.8 Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(windows only)
|
focal |
Not vulnerable
(windows only)
|
|
impish |
Does not exist
|
|
jammy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Not vulnerable
(windows only)
|
|
xenial |
Does not exist
|
|
python3.9 Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
focal |
Not vulnerable
(windows only)
|
|
impish |
Not vulnerable
(windows only)
|
|
jammy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Not vulnerable
(windows only)
|
|
xenial |
Does not exist
|
Severity score breakdown
Parameter | Value |
---|---|
Base score | 7.0 |
Attack vector | Local |
Attack complexity | High |
Privileges required | Low |
User interaction | None |
Scope | Unchanged |
Confidentiality | High |
Integrity impact | High |
Availability impact | High |
Vector | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |