{"id":"CVE-2015-20170","aliases":["CLSA-2022-1658346878","CLSA-2022-1658347112","CLSA-2022-1658347450","CLSA-2022-1658347647","CLSA-2022-1658347999"],"status":"published","title":"Fixed CVE-2015-20170 in python","description":"- CVE-2015-20170: mailcap: findmatch() function does not sanitise the second\n  argument allowing to inject shell commands","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2022-07-20T19:54:38Z","modified":"2026-06-01T00:33:24Z","fixes":[{"ecosystem":"TuxCare:OracleLinux:6","package":"python","fixed_in":["2.6.6-70.el6.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"python-devel","fixed_in":["2.6.6-70.el6.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"python-libs","fixed_in":["2.6.6-70.el6.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"python-test","fixed_in":["2.6.6-70.el6.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"python-tools","fixed_in":["2.6.6-70.el6.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"tkinter","fixed_in":["2.6.6-70.el6.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"python","fixed_in":["2.6.6-70.el6.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"python-devel","fixed_in":["2.6.6-70.el6.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"python-libs","fixed_in":["2.6.6-70.el6.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"python-test","fixed_in":["2.6.6-70.el6.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"python-tools","fixed_in":["2.6.6-70.el6.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"tkinter","fixed_in":["2.6.6-70.el6.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"python2","fixed_in":["2.7.18-4.module_el8.4.0+2071+0b56c8de.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"python2-debug","fixed_in":["2.7.18-4.module_el8.4.0+2071+0b56c8de.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"python2-devel","fixed_in":["2.7.18-4.module_el8.4.0+2071+0b56c8de.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"python2-libs","fixed_in":["2.7.18-4.module_el8.4.0+2071+0b56c8de.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"python2-test","fixed_in":["2.7.18-4.module_el8.4.0+2071+0b56c8de.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"python2-tkinter","fixed_in":["2.7.18-4.module_el8.4.0+2071+0b56c8de.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"python2-tools","fixed_in":["2.7.18-4.module_el8.4.0+2071+0b56c8de.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"platform-python","fixed_in":["3.6.8-39.el8_4.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"platform-python-debug","fixed_in":["3.6.8-39.el8_4.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"platform-python-devel","fixed_in":["3.6.8-39.el8_4.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"python3-devel","fixed_in":["3.6.8-39.el8_4.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"python3-idle","fixed_in":["3.6.8-39.el8_4.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"python3-libs","fixed_in":["3.6.8-39.el8_4.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"python3-test","fixed_in":["3.6.8-39.el8_4.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"python3-tkinter","fixed_in":["3.6.8-39.el8_4.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"platform-python","fixed_in":["3.6.8-41.el8.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"platform-python-debug","fixed_in":["3.6.8-41.el8.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"platform-python-devel","fixed_in":["3.6.8-41.el8.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"python3-devel","fixed_in":["3.6.8-41.el8.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"python3-idle","fixed_in":["3.6.8-41.el8.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"python3-libs","fixed_in":["3.6.8-41.el8.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"python3-test","fixed_in":["3.6.8-41.el8.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"python3-tkinter","fixed_in":["3.6.8-41.el8.tuxcare.els2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.6-70.el6.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"python-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.6-70.el6.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"python-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.6-70.el6.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"python-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.6-70.el6.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"python-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.6-70.el6.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.6-70.el6.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.6-70.el6.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"python-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.6-70.el6.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"python-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.6-70.el6.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"python-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.6-70.el6.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"python-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.6-70.el6.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.6-70.el6.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"python2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-4.module_el8.4.0+2071+0b56c8de.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"python2-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-4.module_el8.4.0+2071+0b56c8de.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"python2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-4.module_el8.4.0+2071+0b56c8de.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"python2-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-4.module_el8.4.0+2071+0b56c8de.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"python2-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-4.module_el8.4.0+2071+0b56c8de.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"python2-tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-4.module_el8.4.0+2071+0b56c8de.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"python2-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-4.module_el8.4.0+2071+0b56c8de.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"platform-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-39.el8_4.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"platform-python-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-39.el8_4.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"platform-python-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-39.el8_4.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"python3-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-39.el8_4.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"python3-idle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-39.el8_4.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"python3-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-39.el8_4.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"python3-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-39.el8_4.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"python3-tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-39.el8_4.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"platform-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-41.el8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"platform-python-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-41.el8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"platform-python-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-41.el8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"python3-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-41.el8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"python3-idle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-41.el8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"python3-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-41.el8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"python3-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-41.el8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"python3-tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-41.el8.tuxcare.els2"}]}]}],"references":[{"url":"https://errata.cloudlinux.com/ol6/CLSA-2022-1658346878.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/els6/CLSA-2022-1658347112.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.4-els/CLSA-2022-1658347450.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.4-els/CLSA-2022-1658347647.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.5-els/CLSA-2022-1658347999.html","tags":["advisory"]}],"sources":{"osv":[{"id":"CLSA-2022-1658346878","title":"Fixed CVE-2015-20170 in python","description":"- CVE-2015-20170: mailcap: findmatch() function does not sanitise the second\n  argument allowing to inject shell commands","status":"published","published":"2022-07-20T19:54:38Z","modified":"2026-06-01T00:33:24.52349621Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1658347112","title":"Fixed CVE-2015-20170 in python","description":"- CVE-2015-20170: mailcap: findmatch() function does not sanitise the second\n  argument allowing to inject shell commands","status":"published","published":"2022-07-20T19:58:32Z","modified":"2026-06-01T00:33:15.806295797Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1658347450","title":"Fixed CVE-2015-20170 in python2-4.module_el8.4.0+2071+0b56c8de.tuxcare.els3","description":"- CVE-2015-20170: mailcap: findmatch() function does not sanitise the second\n  argument allowing to inject shell commands","status":"published","published":"2022-07-20T20:04:10Z","modified":"2026-06-01T00:33:19.236278228Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1658347647","title":"Fixed CVE-2015-20170 in python3","description":"- CVE-2015-20170: mailcap: findmatch() function does not sanitise the second\n  argument allowing to inject shell commands","status":"published","published":"2022-07-20T20:07:27Z","modified":"2026-06-01T00:33:19.229486825Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1658347999","title":"Fixed CVE-2015-20170 in python3","description":"- CVE-2015-20170: mailcap: findmatch() function does not sanitise the second\n  argument allowing to inject shell commands","status":"published","published":"2022-07-20T20:13:19Z","modified":"2026-06-01T00:33:13.508475243Z","updated_at":"2026-11-02T15:43:40.176048Z"}]}}