[Jython-dev] Query Regarding CVE-2024-3220

[Nandakrishnan P N <NAN...@ib...>]

Hello Jython-Dev,

I would like to know regarding the vulnerability of CVE-2024-3220 in jython. The description of the vulnerability is as follows:
“There is a defect in the CPython standard library module “mimetypes” where on Windows the default list of known file locations are writable meaning other users can create invalid files to cause MemoryError to be raised on Python runtime startup or have file extensions be interpreted as the incorrect file type. This defect is caused by the default locations of Linux and macOS platforms (such as “/etc/mime.types”) also being used on Windows, where they are user-writable locations (“C:\etc\mime.types”). To work-around this issue a user can call mimetypes.init() with an empty list (“[]”) on Windows platforms to avoid using the default list of known file locations.”

Link: https://nvd.nist.gov/vuln/detail/CVE-2024-3220
           https://access.redhat.com/security/cve/CVE-2024-3220

Can jython  be vulnerable to this ? If yes, is there any fix in plan?

>From my understanding, this is a low vulnerability and the level of vulnerability depends on how the user use jython. The work around for the issue is that, a user can call mimetypes.init() with an empty list. Please share your insights.

I’m new to jython-user group. Please let me know if there is  any other way to communicate these details.

Thanks & Regards
Nandakrishnan P N
Software Developer , IBM