Vulnerability in Oracle Communications Cloud Native Core Network Function Environment
CVE-2020-27619
In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.083 (94.8th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 95th percentile — 94.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.083 · newest: 0.083 · change: 0.000
Affected products
- Oracle Communications Cloud Native Core Network Function Environment — versions 22.2.0
- Python
- Fedoraproject Fedora — versions 33, 34
Public proof-of-concept exploits
References
- bugs.python.org/issue41944 (Patch, Issue Tracking, Vendor Advisory)
- github.com/python/cpython/commit/2ef5caa58febc8968e670e39e3d37cf8eef3cab8 (Patch, Vendor Advisory)
- github.com/python/cpython/commit/b664a1df4ee71d3760ab937653b10997081b1794 (Patch, Vendor Advisory)
- github.com/python/cpython/commit/6c6c256df3636ff6f6136820afaefa5a10a3ac33 (Patch, Vendor Advisory)
- github.com/python/cpython/commit/43e523103886af66d6c27cd72431b5d9d14cd2a9 (Patch, Vendor Advisory)
- github.com/python/cpython/commit/e912e945f2960029d039d3390ea08835ad39374b (Patch, Vendor Advisory)
- lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac… (mailing-list)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
- lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a4508… (mailing-list)
Frequently asked questions
- What is CVE-2020-27619?
- CVE-2020-27619 is a critical-severity vulnerability in Oracle Communications Cloud Native Core Network Function Environment. CVSS score: 9.8/10. Published 2020-10-22.
- How severe is CVE-2020-27619?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2020-27619 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.