{"id":"CVE-2020-8315","aliases":["ALPINE-CVE-2020-8315","BELL-CVE-2020-8315","BIT-libpython-2020-8315","BIT-python-2020-8315","BIT-python-min-2020-8315","EUVD-2020-29182","GHSA-646c-5wg7-pw2g","PSF-2020-7"],"status":"published","title":"In Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an insecure...","description":"In Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an insecure dependency load upon launch on Windows 7 may result in an attacker's copy of api-ms-win-core-path-l1-1-0.dll being loaded and used instead of the system's copy. Windows 8 and later are unaffected.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01455,"percentile":0.73656,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-427"],"published":"2020-01-28T18:35:58Z","modified":"2026-11-10T10:30:46Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"python3","fixed_in":["3.7.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"python3","fixed_in":["3.8.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"python3","fixed_in":["3.8.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"python3","fixed_in":["3.8.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"python3","fixed_in":["3.8.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"python3","fixed_in":["3.8.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"python3","fixed_in":["3.8.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"python3","fixed_in":["3.8.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"python3","fixed_in":["3.8.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"python3","fixed_in":["3.8.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"python3","fixed_in":["3.8.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"python3","fixed_in":["3.8.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"python3","fixed_in":["3.8.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"python3","fixed_in":["3.8.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"python3","fixed_in":["3.8.2-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"libpython","fixed_in":["3.6.11","3.7.7","3.8.2"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"python","fixed_in":["3.6.11","3.7.7","3.8.2"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"python-min","fixed_in":["3.6.11","3.7.7","3.8.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"libpython","ranges":[{"type":"SEMVER","events":[{"introduced":"3.6.0"},{"fixed":"3.6.11"},{"introduced":"3.7.0"},{"fixed":"3.7.7"},{"introduced":"3.8.0"},{"fixed":"3.8.2"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"python","ranges":[{"type":"SEMVER","events":[{"introduced":"3.6.0"},{"fixed":"3.6.11"},{"introduced":"3.7.0"},{"fixed":"3.7.7"},{"introduced":"3.8.0"},{"fixed":"3.8.2"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"python-min","ranges":[{"type":"SEMVER","events":[{"introduced":"3.6.0"},{"fixed":"3.6.11"},{"introduced":"3.7.0"},{"fixed":"3.7.7"},{"introduced":"3.8.0"},{"fixed":"3.8.2"}]}]}],"products":[{"vendor":"python","product":"python"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"}],"references":[{"url":"https://bugs.python.org/issue39401","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Vendor Advisory","advisory","fix","report"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8315","tags":["web"]},{"url":"https://github.com/advisories/GHSA-646c-5wg7-pw2g"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-8315","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2020-8315","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-8315","description":"In Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an insecure dependency load upon launch on Windows 7 may result in an attacker's copy of api-ms-win-core-path-l1-1-0.dll being loaded and used instead of the system's copy. Windows 8 and later are unaffected.","status":"published","published":"2020-01-28T18:35:58Z","modified":"2026-10-14T08:40:23.162Z","updated_at":"2026-11-02T14:35:50.88562Z"}],"euvd":[{"id":"EUVD-2020-29182","description":"In Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an insecure dependency load upon launch on Windows 7 may result in an attacker's copy of api-ms-win-core-path-l1-1-0.dll being loaded and used instead of the system's copy. Windows 8 and later are unaffected.","status":"published","published":"2020-01-28T18:35:58Z","modified":"2026-10-14T08:40:23Z","updated_at":"2026-11-02T17:27:17.374818Z"}],"ghsa":[{"id":"GHSA-646c-5wg7-pw2g","title":"In Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an insecure...","description":"In Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an insecure dependency load upon launch on Windows 7 may result in an attacker's copy of api-ms-win-core-path-l1-1-0.dll being loaded and used instead of the system's copy. Windows 8 and later are unaffected.","status":"published","published":"2022-05-24T17:07:38Z","modified":"2026-10-14T09:32:30Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-20","CWE-427"],"updated_at":"2026-11-02T15:13:23.530725Z"}],"nvd":[{"id":"CVE-2020-8315","description":"In Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an insecure dependency load upon launch on Windows 7 may result in an attacker's copy of api-ms-win-core-path-l1-1-0.dll being loaded and used instead of the system's copy. Windows 8 and later are unaffected.","status":"published","published":"2020-01-28T19:15:17.5Z","modified":"2026-10-14T09:17:21.327Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-427"],"updated_at":"2026-11-02T14:05:53.837808Z"}],"osv":[{"id":"ALPINE-CVE-2020-8315","description":"In Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an insecure dependency load upon launch on Windows 7 may result in an attacker's copy of api-ms-win-core-path-l1-1-0.dll being loaded and used instead of the system's copy. Windows 8 and later are unaffected.","status":"published","published":"2020-01-28T19:15:17.5Z","modified":"2026-10-26T11:17:55.184924056Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:48.11886Z"},{"id":"BELL-CVE-2020-8315","title":"CVE-2020-8315 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:58.19575Z","modified":"2026-01-26T09:47:38.305496Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:15.925958Z"},{"id":"CVE-2020-8315","description":"In Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an insecure dependency load upon launch on Windows 7 may result in an attacker's copy of api-ms-win-core-path-l1-1-0.dll being loaded and used instead of the system's copy. Windows 8 and later are unaffected.","status":"published","published":"2020-01-28T19:15:17.5Z","modified":"2026-11-10T10:30:46.776918772Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-10T10:57:25.458985Z"},{"id":"BIT-libpython-2020-8315","description":"In Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an insecure dependency load upon launch on Windows 7 may result in an attacker's copy of api-ms-win-core-path-l1-1-0.dll being loaded and used instead of the system's copy. Windows 8 and later are unaffected.","status":"published","published":"2025-08-11T13:51:37.536Z","modified":"2026-09-08T08:48:08.822594572Z","updated_at":"2026-11-02T15:28:32.162822Z"},{"id":"BIT-python-2020-8315","description":"In Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an insecure dependency load upon launch on Windows 7 may result in an attacker's copy of api-ms-win-core-path-l1-1-0.dll being loaded and used instead of the system's copy. Windows 8 and later are unaffected.","status":"published","published":"2024-03-06T11:07:17.883Z","modified":"2026-09-08T08:48:18.904117015Z","updated_at":"2026-11-02T15:28:34.724063Z"},{"id":"BIT-python-min-2020-8315","description":"In Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an insecure dependency load upon launch on Windows 7 may result in an attacker's copy of api-ms-win-core-path-l1-1-0.dll being loaded and used instead of the system's copy. Windows 8 and later are unaffected.","status":"published","published":"2025-01-16T07:23:49.787Z","modified":"2026-09-08T08:47:30.042191455Z","updated_at":"2026-11-02T15:28:34.724063Z"},{"id":"PSF-2020-7","title":"CVE-2020-8315: Unsafe DLL loading in getpathp.c on Windows 7","description":"In Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an insecure dependency load upon launch on Windows 7 may result in an attacker's copy of api-ms-win-core-path-l1-1-0.dll being loaded and used instead of the system's copy. Windows 8 and later are unaffected.","status":"published","published":"2020-01-28T18:35:58Z","modified":"2025-10-09T01:01:04.714806Z","updated_at":"2026-11-02T15:52:50.263679Z"}]}}