Vulnerabilities related to Python

CVE-2015-20107: In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9

CVE-2020-1073: A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'.

CVE-2022-45061: An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16.

Symptoms

This issue is currently rated as having moderate severity.

Resolution

The latest for Platform Release 32 is 3.11.2

Reference:  https://documentation.commvault.com/2023e/expert/121377_third_party_applications_installed_by_commvault_installer.html

Note:

• On supported Python versions in a Commvault feature release, you can upgrade to any latest patch update (for example, if the current version is Python 3.9.13, then you can upgrade to any Python 3.9.* version), but you should not perform a major Python version upgrade to anything other than the supported version.
• Do not uninstall the existing version of Python. You should only upgrade Python on the same installation path for patch updates.

Link for ref:  https://kb.commvault.com/article/69232