CVE-2023-41105

Name	CVE-2023-41105
Description	An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.normpath(), the path will be truncated unexpectedly at the first '\0' byte. There are plausible cases in which an application would have rejected a filename for security reasons in Python 3.10.x or earlier, but that filename is no longer rejected in Python 3.11.x.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
python2.7 (PTS)	bullseye	2.7.18-8+deb11u1	fixed
python3.11 (PTS)	bookworm	3.11.2-6+deb12u2	fixed
	sid	3.11.9-1	fixed
python3.12 (PTS)	sid, trixie	3.12.4-3	fixed
python3.9 (PTS)	bullseye	3.9.2-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
python2.7	source	(unstable)	(not affected)
python3.10	source	(unstable)	(not affected)
python3.11	source	bookworm	3.11.2-6+deb12u2
python3.11	source	(unstable)	3.11.5-1
python3.12	source	(unstable)	3.12.0~rc1-2
python3.7	source	(unstable)	(not affected)
python3.9	source	(unstable)	(not affected)

Notes

- python3.10 <not-affected> (Vulnerable code introduced in 3.11.y)
- python3.9 <not-affected> (Vulnerable code introduced in 3.11.y)
- python3.7 <not-affected> (Vulnerable code introduced in 3.11.y)
- python2.7 <not-affected> (Vulnerable code introduced in 3.11.y)
https://github.com/python/cpython/issues/106242
https://github.com/python/cpython/pull/107983
Backport for 3.12: https://github.com/python/cpython/pull/107981
Backport for 3.11: https://github.com/python/cpython/pull/107982