PyPI: python
CVE-2019-13404
Safety vulnerability ID: SFTY-20190708-17644
Safety legacy ID: pyup.io-70573
The MSI installer for Python through 2.7.16 on Windows defaults to the C:\Python27 directory, which makes it easier for local users to deploy Trojan horse code: a privilege escalation vulnerability. This issue also affects old 3.x releases before 3.5. NOTE: the vendor's position is that it is the user's responsibility to ensure C:\Python27 access control or choose a different directory because backwards compatibility requires that C:\Python27 remain the default for 2.7.x.
Overview
The MSI installer for Python through 2.7.16 on Windows defaults to the C:\Python27 directory, which makes it easier for local users to deploy Trojan horse code: a privilege escalation vulnerability. This issue also affects old 3.x releases before 3.5. NOTE: the vendor's position is that it is the user's responsibility to ensure C:\Python27 access control or choose a different directory because backwards compatibility requires that C:\Python27 remain the default for 2.7.x.
Advisory
The MSI installer for Python through 2.7.16 on Windows defaults to the C:\Python27 directory, which makes it easier for local users to deploy Trojan horse code: a privilege escalation vulnerability. This issue also affects old 3.x releases before 3.5. NOTE: the vendor's position is that it is the user's responsibility to ensure C:\Python27 access control or choose a different directory because backwards compatibility requires that C:\Python27 remain the default for 2.7.x.
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more