CVE-2023-41105
highpriority · track · 31EPSS 0.026 · 85 %ileDEEUNLRUUSEPSS · scored 2026-10-22
An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.normpath(), the path will be truncated unexpectedly at the first '\0' byte. There are plausible cases in which an application would have rejected a filename for security reasons in Python 3.10.x or earlier, but that filename is no longer rejected in Python 3.11.x.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (28)
Products and version ranges known to be affected.
- siebel_crm_cloud_applicationsall versionsncsc_nlNLcpe:2.3:a:oracle:siebel_crm_cloud_applications:*:*:*:*:*:*:*:*
advisories (9)
Vendor and ecosystem advisories describing this.
- NCSC-2024-0305Kwetsbaarheden verholpen in Oracle Siebel CRMNL2024-07-17csaf · ncsc_nlNL
Er zijn kwetsbaarheden verholpen in Oracle Siebel CRM.
- WID-SEC-W-2023-2256Python: Schwachstelle ermöglicht nicht spezifizierten AngriffDeutsch2023-09-03csaf · cert_bundDE
Ein entfernter anonymer Angreifer kann eine Schwachstelle in Python ausnutzen, um einen nicht spezifizierten Angriff durchzuführen.
- WID-SEC-W-2024-0119Oracle MySQL: Mehrere SchwachstellenDeutsch2024-01-16csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle MySQL ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- WID-SEC-W-2024-0794Dell ECS: Mehrere SchwachstellenDeutsch2024-04-04csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Dell ECS ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuführen, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuführen, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuführen.
- WID-SEC-W-2024-1653Oracle Siebel CRM: Mehrere SchwachstellenDeutsch2024-07-16csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Siebel CRM ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- BIT-libpython-2023-411052025-08-11vendor · osvUS
An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.normpath(), the path will be truncated unexpectedly at the first '\0' byte. There are plausible cases in which an application would have rejected a filename for security reasons in Python 3.10.x or earlier, but that filename is no longer rejected in Python 3.11.x.
- BIT-python-2023-411052024-10-04vendor · osvUS
An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.normpath(), the path will be truncated unexpectedly at the first '\0' byte. There are plausible cases in which an application would have rejected a filename for security reasons in Python 3.10.x or earlier, but that filename is no longer rejected in Python 3.11.x.
- BIT-python-min-2023-411052025-01-17vendor · osvUS
An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.normpath(), the path will be truncated unexpectedly at the first '\0' byte. There are plausible cases in which an application would have rejected a filename for security reasons in Python 3.10.x or earlier, but that filename is no longer rejected in Python 3.11.x.
- PSF-2023-9os.path.normpath() truncates on null bytes2023-08-24vendor · osvUS
Passing a path with null bytes to the `os.path.normpath()` function causes the returned path to be unexpectedly truncated at the first occurrence of null bytes within the path. Python versions before 3.11.0 didn’t truncate the path on null bytes. If allowlisting is applied before a call to `os.path.normpath()` is used later in the program, the allowlisting can be circumvented if the path containing null bytes is constructed to pass the allowlist but then change to the targeted resource after truncation.
also known as (13)
Other names and identifiers for this entity.
- CNNVD-202308-1930cnnvd
- EUVD-2023-45624enisa_euvd
- ALSA-2023:6494fstec_bdu
- BDU:2024-09261fstec_bdu
- RHSA-2023:6494fstec_bdu
- RHSA-2023:7024fstec_bdu
- USN-6547-1fstec_bdu
- USN-6891-1fstec_bdu
- GHSA-65fx-pmw6-rcfmenisa_euvd
- BIT-libpython-2023-41105osv
- BIT-python-2023-41105osv
- BIT-python-min-2023-41105osv
- PSF-2023-9osv
sources
Which sources assert this record, and when.
references (21)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2023-41105/cnnvd
- https://github.com/python/cpython/issues/106242cnnvd
- https://github.com/python/cpython/pull/107981cnnvd
- https://github.com/python/cpython/pull/107982cnnvd
- https://github.com/python/cpython/pull/107983cnnvd
- https://mail.python.org/archives/list/security-announce@python.org/thread/D6CDW3ZZC5D444YGL3VQUY6D4ECMCQLD/cnnvd
- https://security.netapp.com/advisory/ntap-20231006-0015/cnnvd
- https://www.oracle.com/security-alerts/cpujan2024.htmlcnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan