Python Security

This page is an attempt to document security vulnerabilities in Python and the versions including the fix.

Pages

Python branches

  • (Latest update: 2017-03-28) Python 2.6, 3.0, 3.1, 3.2 don’t get security fixes anymore and so should be considered as vulnerable
  • Branches getting security fixes: 2.7, 3.3, 3.4 and 3.5
  • See Status of Python branches

Dangerous functions and modules

  • Python 2 input()
  • Python 2 execfile()
  • eval()
  • subprocess.Popen(shell=True)
  • str.format(), Python 3 str.format_map, and Python 2 unicode.format() all allow arbitrary attribute access on formatted values, and hence access to Python’s introspection features: Be Careful with Python’s New-Style String Format (Armin Ronacher, December 2016)
  • The pickle module executes arbitrary Python code: never use it with untrusted data.
  • archives:
    • tarfile: Never extract archives from untrusted sources without prior inspection. It is possible that files are created outside of path, e.g. members that have absolute filenames starting with “/” or filenames with two dots ”..”.
    • zipfile: Never extract archives from untrusted sources without prior inspection. It is possible that files are created outside of path, e.g. members that have absolute filenames starting with “/” or filenames with two dots ”..”. zipfile attempts to prevent that.

Security model

Bytecode

CPython doesn’t verify that bytecode is safe. If an attacker is able to execute arbitrary bytecode, we consider that the security of the bytecode is the least important issue: using bytecode, sensitive code can be imported and executed.

For example, the marshal doesn’t validate inputs.

Sandbox

Don’t try to build a sandbox inside CPython. The attack surface is too large. Python has many introspection features, see for example the inspect module. Python also many convenient features which executes code on demand. Examples:

  • the literal string '\N{Snowman}' imports the unicodedata module
  • the code to log a warning might be abused to execute code

The good design is to put CPython into a sandbox, not the opposite.

Ok, understood, but I want a sandbox in Python. Well...

RNG

The random module must not be used in security sensitive code, except of the random.SystemRandom class.

CPython Security Experts

  • Alex Gaynor
  • Antoine Pitrou
  • Christian Heimes
  • Donald Stufft

Misc

Python Security Response Team (PSRT)