| Name | CVE-2020-8315 |
| Description | In Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an insecure dependency load upon launch on Windows 7 may result in an attacker's copy of api-ms-win-core-path-l1-1-0.dll being loaded and used instead of the system's copy. Windows 8 and later are unaffected. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| python2.7 (PTS) | buster | 2.7.16-2+deb10u1 | fixed |
| buster (security) | 2.7.16-2+deb10u4 | fixed | |
| bullseye | 2.7.18-8+deb11u1 | fixed | |
| python3.7 (PTS) | buster | 3.7.3-2+deb10u3 | fixed |
| buster (security) | 3.7.3-2+deb10u7 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| python2.7 | source | (unstable) | (not affected) | |||
| python3.7 | source | (unstable) | (not affected) | |||
| python3.8 | source | (unstable) | (not affected) |
- python3.8 <not-affected> (Windows-specific)
- python3.7 <not-affected> (Windows-specific)
- python2.7 <not-affected> (Vulnerable code not present)
https://bugs.python.org/issue39401