The severity is MEDIUM because while the misuse of os.path.commonprefix() can lead to security issues, it requires specific conditions and user error. The function will be deprecated in Python 3.15, which mitigates future vulnerabilities.
The Python os.path.commonprefix() API has been misused for decades due to its confusing behavior, leading to potential security issues. This affects all users of the Python standard library who rely on this function for path validation.
Affected Systems
- Python
Affected Versions: all versions before 3.15
Remediation
- Replace usage of os.path.commonprefix() with a safe alternative or custom function that correctly handles path validation.
- Apply the fix mentioned in the advisory for is_within_directory(). Add a '/' terminator to ensure character-by-character comparison works safely.
Stack Impact
This affects Python applications and libraries that use os.path.commonprefix(), such as pip's path validation logic. No direct impact on nginx, docker, linux kernel, openssh, curl, openssl, or other listed components.