Python security issues
Who has ever �been there?
Who has ever �been there?
As of today there �are 61 open “security” issues
I looked at *some*�of them
TLDR: it’s about logging.config.listen()
...which listens on 127.0.0.1:PORT�And may use eval on the input
TLDR:� tempfile.NamedTemporaryFile(prefix=..., suffix=...)�
...both kwargs allows path traversing
(so you can create a temporary file anywhere)
https://bugs.python.org/issue34915
TLDR:�Another users [on the machine] can steal your�saved cookies :(
* or through a path traversal attack...
^DEMO
???
Python interpreter uses whatever libreadline library it founds, even in a current dir…
* Found in the tracker, couldn’t find the issue number...
???
Python interpreter uses whatever libreadline library it founds, even in a current dir…
* Found in the tracker, couldn’t find the issue number...
???
Python interpreter uses whatever libreadline library it founds, even in a current dir…
* Found in the tracker, couldn’t find the issue number...
Let’s demo