CVE-2023-41105

Name	CVE-2023-41105
Description	An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.normpath(), the path will be truncated unexpectedly at the first '\0' byte. There are plausible cases in which an application would have rejected a filename for security reasons in Python 3.10.x or earlier, but that filename is no longer rejected in Python 3.11.x.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
pypy (PTS)	jessie	2.4.0+dfsg-3	fixed
	stretch	5.6.0+dfsg-4	fixed
	buster	7.0.0+dfsg-3	fixed
	bullseye	7.3.3+dfsg-2	fixed
python2.7 (PTS)	jessie, jessie (lts)	2.7.9-2-ds1-1+deb8u12	fixed
	stretch (security)	2.7.13-2+deb9u6	fixed
	stretch (lts), stretch	2.7.13-2+deb9u9	fixed
	buster (security), buster, buster (lts)	2.7.16-2+deb10u4	fixed
	bullseye	2.7.18-8+deb11u1	fixed
python3.11 (PTS)	bookworm	3.11.2-6+deb12u4	fixed
	bookworm (security)	3.11.2-6+deb12u3	fixed
python3.12 (PTS)	sid, trixie	3.12.7-3	fixed
python3.4 (PTS)	jessie, jessie (lts)	3.4.2-1+deb8u18	fixed
python3.5 (PTS)	stretch (security)	3.5.3-1+deb9u5	fixed
	stretch (lts), stretch	3.5.3-1+deb9u10	fixed
python3.7 (PTS)	buster, buster (lts)	3.7.3-2+deb10u8	fixed
	buster (security)	3.7.3-2+deb10u7	fixed
python3.9 (PTS)	bullseye	3.9.2-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
pypy	source	(unstable)	(not affected)
python2.7	source	(unstable)	(not affected)
python3.10	source	(unstable)	(not affected)
python3.11	source	bookworm	3.11.2-6+deb12u2
python3.11	source	(unstable)	3.11.5-1
python3.12	source	(unstable)	3.12.0~rc1-2
python3.4	source	(unstable)	(not affected)
python3.5	source	(unstable)	(not affected)
python3.7	source	(unstable)	(not affected)
python3.9	source	(unstable)	(not affected)

Notes

- python3.10 <not-affected> (Vulnerable code introduced in 3.11.y)
- python3.9 <not-affected> (Vulnerable code introduced in 3.11.y)
- python3.7 <not-affected> (Vulnerable code introduced in 3.11.y)
- python2.7 <not-affected> (Vulnerable code introduced in 3.11.y)
https://github.com/python/cpython/issues/106242
https://github.com/python/cpython/pull/107983
Backport for 3.12: https://github.com/python/cpython/pull/107981
Backport for 3.11: https://github.com/python/cpython/pull/107982
- pypy <not-affected> (Vulnerable code introduced in 3.11.y)
- python3.4 <not-affected> (Vulnerable code introduced in 3.11.y)
- python3.5 <not-affected> (Vulnerable code introduced in 3.11.y)