Vulnerability · Published Feb 14, 2025 · Assigned by PSF
CVE-2024-3220Default mimetype known files writeable on Windows
Low 2.3
In plain English
A low-severity security flaw in CPython from Python Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
There is a defect in the CPython standard library module “mimetypes” where on Windows the default list of known file locations are writable meaning other users can create invalid files to cause MemoryError to be raised on Python runtime startup or have file extensions be interpreted as the incorrect file type. This defect is caused by the default locations of Linux and macOS platforms (such as “/etc/mime.types”) also being used on Windows, where they are user-writable locations (“C:\etc\mime.types”). To work-around this issue a user can call mimetypes.init() with an empty list (“[]”) on Windows platforms to avoid using the default list of known file locations.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.21 | python3 | 3.12.16-r0 | ALPINE-CVE-2024-3220 |
| Alpine:v3.22 | python3 | 3.12.16-r0 | ALPINE-CVE-2024-3220 |
| Alpine:v3.23 | python3 | 3.12.16-r0 | ALPINE-CVE-2024-3220 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Python Software Foundation | CPython | 0 – before 3.11.183.12.0 – before 3.12.163.13.0 – before 3.13.183.14.0 – before 3.14.93.15.0 – before 3.15.13.16.0a1 – before 3.16.0 |
Weakness: CWE-426 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
References
- https://mail.python.org/archives/list/security-announce@python.org/thread/CDXW34ND2LSAOYAR5N6UNONP4ZBX4D6R/ vendor-advisory
- https://github.com/python/cpython/issues/159428 issue-tracking
- https://github.com/python/cpython/commit/04a29bf8f9ff8526cd96cb7368400173303a390a patch
- https://github.com/python/cpython/commit/5550519259656cbb8eeac09e3dbc0d5c248a4dea patch
- https://github.com/python/cpython/commit/76f4555c4ff10f5dda58d6528c17787df41e256c patch
- https://github.com/python/cpython/commit/2f00690fd5a75305e02c99628a41439179266f29 patch
- https://github.com/python/cpython/commit/35dd324f6e30735162a68cde84bb04a169004325 patch
- https://github.com/python/cpython/commit/8d4286a3f41d36f42c4b4cf5c4451a5a8c23fe87 patch
- http://www.openwall.com/lists/oss-security/2025/02/14/8
- https://security.netapp.com/advisory/ntap-20250314-0001/