In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call…
Priority MEDIUM 60Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 6 fixed, 5 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.
Summary
In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.08334 94th percentileScored 2026-11-07
Fix Partial Red Hat: 5 advisoriesRed Hat: 6 fixed, 5 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:python:python:*:*:*:*:*:*:*:* | 3.0.0 to before 3.6.13; 3.7.0 to before 3.7.10; 3.8.0 to before 3.8.7; 3.9.0 to before 3.9.1 | Vulnerable | python-pillow |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 33 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 34 | Vulnerable | Fedoraproject |
| cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:22.2.0:*:*:*:*:*:*:* | 22.2.0 | Vulnerable | Oracle |
- cpe:2.3:a:python:python:*:*:*:*:*:*:*:* Versions 3.0.0 to before 3.6.13; 3.7.0 to before 3.7.10; 3.8.0 to before 3.8.7; 3.9.0 to before 3.9.1 Vulnerable ·python-pillow
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
- cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:22.2.0:*:*:*:*:*:*:* Versions 22.2.0 Vulnerable ·Oracle
Remediation
Red Hat 5 advisories
- RHSA-2021:4162 Released 2021-11-09 · Red Hat rating Moderatepython38:3.8 and python38-devel:3.8 security update
- Red Hat CodeReady Linux Builder (v. 8) pytest-4.6.6-3.module+el8.4.0+8888+89bc7e79.src::python38-devel:3.8, python-atomicwrites-1.3.0-8.module+el8.4.0+8888+89bc7e79.src::python38-devel:3.8, python-attrs-19.3.0-3.module+el8.4.0+8888+89bc7e79.src::python38-devel:3.8 +15
- Red Hat Enterprise Linux AppStream (v. 8) Cython-0.29.14-4.module+el8.4.0+8888+89bc7e79.src::python38:3.8, PyYAML-5.4.1-1.module+el8.5.0+10721+14d8e0d5.src::python38:3.8, babel-2.7.0-11.module+el8.5.0+11015+9c1c7c42.src::python38:3.8 +47
- RHSA-2021:4151 Released 2021-11-09 · Red Hat rating Moderatepython27:2.7 security update
- Red Hat Enterprise Linux AppStream (v. 8) Cython-0.28.1-7.module+el8.1.0+3111+de3f2d8e.src::python27:2.7, PyYAML-3.12-16.module+el8.1.0+3111+de3f2d8e.src::python27:2.7, babel-2.5.1-10.module+el8.5.0+11014+88fc0d0b.noarch::python27:2.7 +47
- RHSA-2021:3252 Released 2021-08-24 · Red Hat rating Moderatepython27 security update
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) python27-babel-0.9.6-10.el7, python27-python-2.7.18-3.el7, python27-python-babel-0.9.6-10.el7 +8
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) python27-babel-0.9.6-10.el7, python27-python-2.7.18-3.el7, python27-python-babel-0.9.6-10.el7 +8
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) python27-babel-0.9.6-10.el7, python27-python-2.7.18-3.el7, python27-python-babel-0.9.6-10.el7 +8
Show 2 more Red Hat advisories
- RHSA-2021:3254 Released 2021-08-24 · Red Hat rating Moderaterh-python38 security, bug fix, and enhancement update
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-python38-babel-2.7.0-12.el7, rh-python38-python-3.8.11-2.el7, rh-python38-python-babel-2.7.0-12.el7 +14
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-python38-babel-2.7.0-12.el7, rh-python38-python-3.8.11-2.el7, rh-python38-python-babel-2.7.0-12.el7 +14
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-python38-babel-2.7.0-12.el7, rh-python38-python-3.8.11-2.el7, rh-python38-python-babel-2.7.0-12.el7 +14
- RHSA-2021:1633 Released 2021-05-18 · Red Hat rating Moderatepython3 security update
- Red Hat Enterprise Linux AppStream (v. 8) platform-python-3.6.8-37.el8, platform-python-debug-3.6.8-37.el8, platform-python-devel-3.6.8-37.el8 +3
- Red Hat Enterprise Linux BaseOS (v. 8) platform-python-3.6.8-37.el8, python3-3.6.8-37.el8, python3-libs-3.6.8-37.el8 +1
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 5 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Quay 3 | Affected | No fix planned: Will not fix |
| Red Hat Software Collections | Affected | No fix planned: Out of support scope |
| Red Hat CodeReady Linux Builder (v. 8) | Fixed | RHSA-2021:4162 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2021:1633, RHSA-2021:4151, RHSA-2021:4162 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2021:1633 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2021:3252, RHSA-2021:3254 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) | Fixed | RHSA-2021:3252, RHSA-2021:3254 |
| Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2021:3252, RHSA-2021:3254 |
Not affected: 1 product
- Red Hat Enterprise Linux 8
Timeline
- 2026-10-02 Threatist record created from CVE-2020-27619
- 2026-10-03 Alias added: GHSA-22cq-cq7f-8jm3
- 2026-10-08 CISA SSVC decision points changed
References
Patch 7
- https://bugs.python.org/issue41944
- https://github.com/python/cpython/commit/2ef5caa58febc8968e670e39e3d37cf8eef3cab8
- https://github.com/python/cpython/commit/b664a1df4ee71d3760ab937653b10997081b1794
- https://github.com/python/cpython/commit/6c6c256df3636ff6f6136820afaefa5a10a3ac33
- https://github.com/python/cpython/commit/43e523103886af66d6c27cd72431b5d9d14cd2a9
- https://github.com/python/cpython/commit/e912e945f2960029d039d3390ea08835ad39374b
- https://www.oracle.com/security-alerts/cpujul2022.html
Advisory 4
Other 3
- [mina-dev] 20210225 [jira] [Created] (FTPSERVER-500) Security vulnerability in common/lib/log4j-1.2.17.jar
- [bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8
- [bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8
Sources
- CVE-2020-27619 · CVE Program
- CVE-2020-27619 · NVD
- FIRST EPSS
- GHSA-22cq-cq7f-8jm3 · GitHub Advisory Database · CC BY 4.0
- CVE-2020-27619 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences