GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — gh-114539: Clarify implicit launching of shells by subprocess by zooba · Pull Request #117996 · python/cpython

Conversation

@zooba

@zooba zooba commented Apr 17, 2024 •
edited by github-actions Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member

This is the same issue as recently disclosed by Rust (CVE-2024-24576), but as it is intentional operating system behaviour, we consider it to not be a Python vulnerability. If an attacker can influence the executable argument and other arguments, no reasonable validation can detect this case (without actually launching the executable and seeing what happens), and the app is exploitable already.

Rust was already detecting whether the executable was a batch file and changing their behaviour, which is why they chose to apply a fix. Python does no such detection, but relies exclusively on the shell argument.

  • Issue: [doc] subprocess security considerations needs a Windows-specific exception #114539

📚 Documentation preview 📚: https://cpython-previews--117996.org.readthedocs.build/

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@zooba
pythongh-114539: Clarify implicit lauching of shells in subprocess
ae08dd8
@zooba zooba added docs Documentation in the Doc dir type-security A security issue needs backport to 3.8 needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes labels Apr 17, 2024
@bedevere-app bedevere-app Bot mentioned this pull request Apr 17, 2024
[doc] subprocess security considerations needs a Windows-specific exception #114539
Closed
@bedevere-app bedevere-app Bot added skip news awaiting core review labels Apr 17, 2024
@zooba
Adds GH reference
ab79e76
sethmlarson
sethmlarson approved these changes Apr 17, 2024
View reviewed changes

@sethmlarson sethmlarson left a comment

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks Steve! LGTM

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
gpshead
gpshead approved these changes Apr 17, 2024
View reviewed changes
@bedevere-app bedevere-app Bot added awaiting merge and removed awaiting core review labels Apr 17, 2024
@zooba
zooba merged commit a4b44d3 into python:main Apr 17, 2024
@miss-islington-app

miss-islington-app Bot commented Apr 17, 2024

Copy link
Copy Markdown

Thanks @zooba for the PR 🌮🎉.. I'm working now to backport this PR to: 3.8, 3.9, 3.10, 3.11, 3.12.
🐍🍒⛏🤖
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the awaiting merge label Apr 17, 2024
@zooba
zooba deleted the gh-114539 branch April 17, 2024 18:32
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Apr 17, 2024
@zooba @miss-islington
pythongh-114539: Clarify implicit launching of shells by subprocess (p…
b7f8c77 
…ythonGH-117996)

(cherry picked from commit a4b44d3)

Co-authored-by: Steve Dower <[email protected]>
@bedevere-app

bedevere-app Bot commented Apr 17, 2024

Copy link
Copy Markdown

GH-118002 is a backport of this pull request to the 3.12 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.12 only security fixes label Apr 17, 2024
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Apr 17, 2024
@zooba @miss-islington
pythongh-114539: Clarify implicit launching of shells by subprocess (p…
085ad6a 
…ythonGH-117996)

(cherry picked from commit a4b44d3)

Co-authored-by: Steve Dower <[email protected]>
@bedevere-app

bedevere-app Bot commented Apr 17, 2024

Copy link
Copy Markdown

GH-118003 is a backport of this pull request to the 3.11 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.11 only security fixes label Apr 17, 2024
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Apr 17, 2024
@zooba @miss-islington
pythongh-114539: Clarify implicit launching of shells by subprocess (p…
f03a28f 
…ythonGH-117996)

(cherry picked from commit a4b44d3)

Co-authored-by: Steve Dower <[email protected]>
@bedevere-app

bedevere-app Bot commented Apr 17, 2024

Copy link
Copy Markdown

GH-118004 is a backport of this pull request to the 3.10 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.10 label Apr 17, 2024
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Apr 17, 2024
@zooba @miss-islington
pythongh-114539: Clarify implicit launching of shells by subprocess (p…
3fc8a8b 
…ythonGH-117996)

(cherry picked from commit a4b44d3)

Co-authored-by: Steve Dower <[email protected]>
@bedevere-app

bedevere-app Bot commented Apr 17, 2024

Copy link
Copy Markdown

GH-118005 is a backport of this pull request to the 3.9 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.9 label Apr 17, 2024
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Apr 17, 2024
@zooba @miss-islington
pythongh-114539: Clarify implicit launching of shells by subprocess (p…
89632e6 
…ythonGH-117996)

(cherry picked from commit a4b44d3)

Co-authored-by: Steve Dower <[email protected]>
@bedevere-app

bedevere-app Bot commented Apr 17, 2024

Copy link
Copy Markdown

GH-118006 is a backport of this pull request to the 3.8 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.8 label Apr 17, 2024
zooba added a commit that referenced this pull request Apr 17, 2024
@miss-islington @zooba
[3.12] gh-114539: Clarify implicit launching of shells by subprocess (G…
859fdee 
…H-117996) (#118002)

gh-114539: Clarify implicit launching of shells by subprocess (GH-117996)
(cherry picked from commit a4b44d3)

Co-authored-by: Steve Dower <[email protected]>
ambv pushed a commit that referenced this pull request May 7, 2024
@miss-islington @zooba
[3.10] gh-114539: Clarify implicit launching of shells by subprocess (G…
9b33629 
…H-117996) (GH-118004)

(cherry picked from commit a4b44d3)

Co-authored-by: Steve Dower <[email protected]>
ambv pushed a commit that referenced this pull request May 7, 2024
@miss-islington @zooba
[3.9] gh-114539: Clarify implicit launching of shells by subprocess (G…
22ae383 
…H-117996) (GH-118005)

(cherry picked from commit a4b44d3)

Co-authored-by: Steve Dower <[email protected]>
ambv pushed a commit that referenced this pull request May 7, 2024
@miss-islington @zooba
[3.8] gh-114539: Clarify implicit launching of shells by subprocess (G…
14ac620 
…H-117996) (GH-118006)

(cherry picked from commit a4b44d3)

Co-authored-by: Steve Dower <[email protected]>
hugovk pushed a commit that referenced this pull request Aug 9, 2024
@miss-islington @zooba
[3.11] gh-114539: Clarify implicit launching of shells by subprocess (G…
b396360 
…H-117996) (#118003)

Co-authored-by: Steve Dower <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gpshead gpshead gpshead approved these changes
@sethmlarson sethmlarson sethmlarson approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

docs Documentation in the Doc dir skip news type-security A security issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

@zooba @gpshead @sethmlarson
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.