cpython
cpython copied to clipboard
python
Fix for CVE-2022-37460 - Removed "shell=True", made args a list, and revised to handle stdin in function
Fixes a vulnerability (CVE-2022-37460) in the get-remote-certificate script that would allow for remote code execution given malicious host parameter.
NOTE: Issue reported to python security but no gh-#####.
Most changes to Python require a NEWS entry.
Please add it using the blurb_it web app or the blurb command-line tool.
![cpython-cla-bot[bot] avatar](https://avatars.githubusercontent.com/in/171517?v=4 "Published by a pub.dev verified publisher"){kind=small}
Please file an issue in this github repo related to this. adjust the PR title to refer to the gh-#####: issue number. PRs are already public. There is no reason not to file an issue once a PR exists.
(and no need to refer to the CVE as that is being withdrawn)
A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.
Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.
Superseded by https://github.com/python/cpython/pull/97613. Thanks for the PR!
