Configuration Injection via Carriage Return (\r) in write() method
When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-0864US | medium5.5 | — | ||
When using the "configparser" module to write configuration files
containing multi-line text values with carriage return characters (\r) the
resulting file could be injected with u… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/python/cpython/commit/0adb386f6e68eb2e73d32e19f235d012df009528FIX
- https://github.com/python/cpython/commit/12dcbd74d3563016a8cb8c47e4898889f34f74ddFIX
- https://github.com/python/cpython/commit/274de100bbf4345bd0c23ef5b446722e9e636908FIX
- https://github.com/python/cpython/commit/5858e42c539dac8394636a6e9b30472b8994851fFIX
- https://github.com/python/cpython/commit/71f2e02a52d47417a6fd69f456346cd8aa7aca98FIX
- https://github.com/python/cpython/commit/aaf850fd333cd89e9aada03d92aaa788a6cb1bb8FIX
- https://github.com/python/cpython/commit/db4a157c790479710a1a840d7937c5c815a6f8b6FIX
- https://github.com/python/cpython/issues/143927FIX
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan