CVE-2020-8315: Unsafe DLL loading in getpathp.c on Windows 7

Warning

This resource is maintained for historical reference and does not contain the latest vulnerability info for Python.

The canonical database for vulnerabilities affecting Python is available on GitHub in the Open Source Vulnerability (OSV) format. This vulnerability can be viewed online at the Open Source Vulnerability Database.

At Python startup, api-ms-win-core-path-l1-1-0.dll is loaded with LoadLibraryW() without LOAD_LIBRARY_SEARCH_xxx flags.

Python 3.5 and older are not affected.

Dates:

  • Disclosure date: 2020-01-21 (Python issue bpo-39401 reported)

Fixed In

Python issue

[CVE-2020-8315] Unsafe dll loading in getpathp.c on Win7.

  • Python issue: bpo-39401
  • Creation date: 2020-01-21
  • Reporter: Anthony Wee

CVE-2020-8315

In Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an insecure dependency load upon launch on Windows 7 may result in an attacker’s copy of api-ms-win-core-path-l1-1-0.dll being loaded and used instead of the system’s copy. Windows 8 and later are unaffected.

Timeline

Timeline using the disclosure date 2020-01-21 as reference: