Skip to content
Fencer Vulns
high 7.5

CVE-2023-41105 json

An issue was discovered in Python 3.11 through 3.11.4.

published 2023-08-23 3 y ago modified 2026-09-08 2 mo ago also BIT-libpython-2023-41105 , BIT-python-2023-41105 , BIT-python-min-2023-41105 , EUVD-2023-45624

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.6%
EPSS 2.6% chance of exploitation in 30 days, percentile 85%
public exploits
0
none known

Summary

An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.normpath(), the path will be truncated unexpectedly at the first '\0' byte. There are plausible cases in which an application would have rejected a filename for security reasons in Python 3.10.x or earlier, but that filename is no longer rejected in Python 3.11.x.

Patch / fix

  • bitnami libpython 3.11.5
  • bitnami python 3.11.5
  • bitnami python-min 3.11.5
  • python python 3.11.5, 3.12.0rc2
  • python_software_foundation cpython 3.11.5, 3.12.0rc2
  • python_software_foundation python 3.11.5, 3.12.0rc2
  • python3.11 Debian 12 3.11.2-6+deb12u2

debian advisories DEBIAN-CVE-2023-41105

  • python3.11 Ubuntu Pro 22.04 LTS 3.11.0~rc1-1~22.04.1~esm1

ubuntu advisories UBUNTU-CVE-2023-41105

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • python3.11 RHEL 8 3.11.5-1.el8_9
  • python3.11-idle RHEL 8 3.11.5-1.el8_9
  • python3.11-libs RHEL 8 3.11.5-1.el8_9
  • python3.11-test RHEL 8 3.11.5-1.el8_9
  • python3.11-tkinter RHEL 8 3.11.5-1.el8_9
  • python3.11-rpm-macros RHEL 8 3.11.5-1.el8_9
  • python3.11 RHEL 9 3.11.5-1.el9_3
  • python3.11-idle RHEL 9 3.11.5-1.el9_3

red hat advisories RHSA-2023:7024RHSA-2023:6494

  • python311 SLE Module for Python 3 15 SP5, SLE Module for Python 3 15 SP4, openSUSE Leap 15.5 +1 more 3.11.5-150400.9.20.1
  • python311-core SLE Module for Python 3 15 SP5, SLE Module for Python 3 15 SP4, openSUSE Leap 15.5 +1 more 3.11.5-150400.9.20.2
  • python311-documentation SLE Module for Python 3 15 SP5, SLE Module for Python 3 15 SP4, openSUSE Leap 15.5 +1 more 3.11.5-150400.9.20.2
  • python3 SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 +1 more 3.4.10-25.116.1
  • python3-base SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 +1 more 3.4.10-25.116.1

suse advisories SUSE-SU-2023:3943-1SUSE-SU-2023:3939-1

  • python311 openSUSE Tumbleweed 3.11.5-2.1

opensuse advisories openSUSE-SU-2024:13261-1

  • python3.11 AlmaLinux 8 3.11.5-1.el8_9
  • python3.11-idle AlmaLinux 8 3.11.5-1.el8_9
  • python3.11-libs AlmaLinux 8 3.11.5-1.el8_9
  • python3.11-test AlmaLinux 8 3.11.5-1.el8_9
  • python3.11-tkinter AlmaLinux 8 3.11.5-1.el8_9
  • python3.11-rpm-macros AlmaLinux 8 3.11.5-1.el8_9
  • python3.11 AlmaLinux 9 3.11.5-1.el9_3
  • python3.11-idle AlmaLinux 9 3.11.5-1.el9_3

almalinux advisories ALSA-2023:7024ALSA-2023:6494

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-41105 updated cvss 7.5

python: file path truncation at \0 characters

  • Red Hat CodeReady Linux Builder (v. 8) python3.11 3.11.5-1.el8_9, python3.11-idle 3.11.5-1.el8_9, python3.11-libs 3.11.5-1.el8_9, python3.11-test 3.11.5-1.el8_9, python3.11-tkinter 3.11.5-1.el8_9, python3.11-rpm-macros 3.11.5-1.el8_9
    fixed: vendor fix RHSA-2023:7024
  • Red Hat CodeReady Linux Builder (v. 9) python3.11 3.11.5-1.el9_3, python3.11-idle 3.11.5-1.el9_3, python3.11-libs 3.11.5-1.el9_3, python3.11-test 3.11.5-1.el9_3, python3.11-tkinter 3.11.5-1.el9_3
    fixed: vendor fix RHSA-2023:6494
  • Red Hat Enterprise Linux AppStream (v. 8) python3.11 3.11.5-1.el8_9, python3.11-idle 3.11.5-1.el8_9, python3.11-libs 3.11.5-1.el8_9, python3.11-test 3.11.5-1.el8_9, python3.11-tkinter 3.11.5-1.el8_9, python3.11-rpm-macros 3.11.5-1.el8_9
    fixed: vendor fix RHSA-2023:7024
  • Red Hat Enterprise Linux AppStream (v. 9) python3.11 3.11.5-1.el9_3, python3.11-idle 3.11.5-1.el9_3, python3.11-libs 3.11.5-1.el9_3, python3.11-test 3.11.5-1.el9_3, python3.11-tkinter 3.11.5-1.el9_3
    fixed: vendor fix RHSA-2023:6494
  • Red Hat Enterprise Linux 6 python, tkinter, python-libs, python-test, python-tools Red Hat Enterprise Linux 7 python, python3, tkinter, python-libs, python-test, python-tools, +4 more Red Hat Enterprise Linux 8 numpy, scipy, PyYAML, python2, python3, mod_wsgi, +82 more Red Hat Enterprise Linux 9 python3, python3.9, python3-idle, python3-libs, python3-test, python3-tkinter, +1 more Red Hat Software Collections rh-python38-python, rh-python38-python-idle, rh-python38-python-libs, rh-python38-python-test, rh-python38-python-tkinter, rh-python38-python-rpm-macros, +1 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2 y ago

Exploit prediction

2.59% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected packages

ecosystem package affected fixed in
bitnami libpython
>=3.11.0, <3.11.5
3.11.5
bitnami python
>=3.11.0, <3.11.5
3.11.5
bitnami python-min
>=3.11.0, <3.11.5
3.11.5

Affected products

  • python python

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Improve version ranges to indicate fix.