CVE-2017-17522
Python 3.5 and 2 others: Lib/webbrowser.py in Python through 3.6.3 does not validate strings before launching the program specified…
CVE-2017-17522 is fixed in Python 3.6 on 1 platform by Python 3.6 3.6.4 (version 3.6.4), released December 18, 2017. 2 other affected products have no fix yet. It is not reported as exploited. Patch Radar priority: High.
High
CVSS
8.8
No vendor severity
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0360
89th percentile
Lib/webbrowser.py in Python through 3.6.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a software maintainer indicates that exploitation is impossible because the code relies on subprocess.Popen and the default shell=False setting
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Windows apps | |||
| Python 3.6 | 3.6.4 | Python 3.6 3.6.4 | Dec 18, 2017 |
| No fix yet | |||
| Python 2 (Windows apps) | No fix yet | no-fix | n/a |
| Python 3.5 (Windows apps) | No fix yet | no-fix | n/a |