Description

hannob

opened on Nov 30, 2022

Issue body actions

Bug report

The function uu.decode is vulnerable to trivial directory traversal if no output filename is given. An uu-encoded file with a path starting with a repetition of ../../ or a / allows writing a file to an arbitrary location on the filesystem.

I reported this to [email protected] and was asked to report it publicly as the function is rarely used and removal is planned anyway for Python 3.13.

Your environment

CPython versions tested on: 3.10.8
Operating system and architecture: Linux

example files

Case 1:

begin 644 ../../../../../../../../tmp/test1
$86)C"@``
`
end

Case 2:

begin 644 /tmp/test2
$86)C"@``
`
end

Linked PRs

• gh-99889: Fix directory traversal security flaw in uu.decode() #104096
• [3.11] gh-99889: Fix directory traversal security flaw in uu.decode() (GH-104096) #104329
• [3.10] gh-99889: Fix directory traversal security flaw in uu.decode() (GH-104096) #104330
• [3.9] gh-99889: Fix directory traversal security flaw in uu.decode() (GH-104096) #104331
• [3.8] gh-99889: Fix directory traversal security flaw in uu.decode() (GH-104096) #104332
• [3.7] gh-99889: Fix directory traversal security flaw in uu.decode() (GH-104096) #104333

Activity

1. hannob

   added

   type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

   on Nov 30, 2022
2. sobolevn

   added

   type-securityA security issueA security issue

   on Dec 2, 2022
3. samcarroll42

   added a commit that references this issue on May 2, 2023

   pythongh-99889: Fix directory traversal security flaw in uu.decode()

   087561f
4. arhadthedev

   added

   stdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directory

   on May 2, 2023
5. gpshead

   self-assigned this

   on May 9, 2023
6. gpshead

   closed this as completedin #104096on May 9, 2023
7. gpshead

   added a commit that references this issue on May 9, 2023

   gh-99889: Fix directory traversal security flaw in uu.decode() (#104096)

   0aeda29
8. miss-islington

   added 5 commits that reference this issue on May 9, 2023

   pythongh-99889: Fix directory traversal security flaw in uu.decode() (p…

   15d98b4

   pythongh-99889: Fix directory traversal security flaw in uu.decode() (p…

   f0b29a6

   pythongh-99889: Fix directory traversal security flaw in uu.decode() (p…

   4cd4709

   pythongh-99889: Fix directory traversal security flaw in uu.decode() (p…

   bbc1bbd

   pythongh-99889: Fix directory traversal security flaw in uu.decode() (p…

   8bb903e
9. gpshead

   added 2 commits that reference this issue on May 9, 2023

   [3.11] gh-99889: Fix directory traversal security flaw in uu.decode() (…

   4ed59b1

   [3.10] gh-99889: Fix directory traversal security flaw in uu.decode() (…

   cfa4295
10. carljm

    added 3 commits that reference this issue on May 9, 2023

    Merge branch 'main' into fixsendfamily

    e40071d

    Merge branch 'main' into supermon

    c48eee3

    Merge branch 'main' into fixloadsuperspec

    cf11908
11. ambv

    added 2 commits that reference this issue on May 22, 2023

    [3.8] gh-99889: Fix directory traversal security flaw in uu.decode() (G…

    47ec96a

    [3.9] gh-99889: Fix directory traversal security flaw in uu.decode() (G…

    3d5dd1e
12. ned-deily

    added a commit that references this issue on May 27, 2023

    [3.7] gh-99889: Fix directory traversal security flaw in uu.decode() (G…

    1ce801b
13. carlosroman

    added a commit that references this issue on Jun 22, 2023

    Upgrade to 3.8.17 (#26)

    e0a363f
14. zhuofeng6 commented on Jun 27, 2023

    

    zhuofeng6

    on Jun 27, 2023

    More actions

    The permission on the uu.py file is changed from 755 to 644. Is this a misoperation? Why change this permission?
15. arhadthedev commented on Jun 27, 2023

    

    arhadthedev

    on Jun 27, 2023

    Member

    More actions

    @alittlesir Could you file a new issue, please? Here is a chance that core developers do not track the solved ones.

Issue actions