EXPOSURES › CVE-2020-27619
CVE-2020-27619
CRITICAL
DETAIL
SourceNVD · cve
Published2020-10-22
CVSS9.8
Referencehttps://nvd.nist.gov/vuln/detail/CVE-2020-27619 ↗
▸ RECOMMENDED ACTION Critical severity — schedule patching of the affected products.
PLAYERS IMPLICATED
DESCRIPTION
In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP.
SENTIMENT · TRUSTED SOURCES
synthesis
severe-fallout
-0.60
CVE-2020-27619 in Fedora's Python test suite used eval() on HTTP content, a severe security flaw that could allow remote code execution if exploited, though it was in test code and not production, sti
CVE-2020-27619 was a critical vulnerability in Fedora's Python test suite using eval() on HTTP content, widely criticized for allowing potential remote code execution, though limited to test code.
"In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP."
No substantive coverage; only a technical error from a local bridge, providing no sentiment or stance toward Fedora.
AFFECTED FEDRAMP PRODUCTS · 10
| PRODUCT | STATUS |
|---|---|
| Aconex for Defense Oracle |
Authorized |
| Federal Managed Cloud Services Oracle |
Authorized |
| Fusion Cloud Oracle |
Authorized |
| Government Cloud - Common Controls Oracle |
Authorized |
| Oracle Cloud Infrastructure-Government Cloud Oracle |
Authorized |
| Oracle Enterprise Performance Management (EPM) Oracle |
Authorized |
| Oracle Enterprise Performance Management (EPM) - Moderate Oracle |
In Process |
| Oracle Service Cloud Oracle |
Authorized |
| Oracle Service Cloud (DOD) Oracle |
Authorized |
| Taleo Cloud - U.S. Government Cloud Oracle |
Authorized |