{"id":"PSF-2017-8","summary":"Environment variables injection in subprocess on Windows","details":"On Windows, prevent passing invalid environment variables and command\narguments to subprocess.Popen.\n\nIt is possible to inject an environment variable in subprocess on Windows\nif a user data is passed to a subprocess via environment variable.\n\nCheck for invalid environment (variable names containing '=') and command\narguments (containing '\\0').\n","modified":"2025-10-09T00:59:49.228511Z","published":"2017-06-22T00:00:00Z","database_specific":{"cwe_ids":[]},"references":[{"type":"REPORT","url":"https://bugs.python.org/issue30730"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/python/cpython","events":[{"introduced":"0"},{"fixed":"9dda2caca8edc7ff1285f6b0d1c5279b51854b7d"},{"fixed":"a7c0264735f46afab13771be4218d8eab0d7dc91"},{"fixed":"a9b16cff35811f88cdfeb4f50758140dfff36ebc"},{"fixed":"d174d24a5d37d1516b885dc7c82f71ecd5930700"},{"fixed":"e46f1c19642ea1882f427d8246987ba49351a97d"},{"fixed":"fe82c46327effc124ff166e1fa1e611579e1176b"}]}],"versions":["2.5","3.2","v0.9.8","v0.9.9","v1.0.1","v1.0.2","v1.1","v1.1.1","v1.2","v1.2b1","v1.2b2","v1.2b3","v1.2b4","v1.3","v1.3b1","v1.4","v1.4b1","v1.4b2","v1.4b3","v1.5","v1.5.1","v1.5.2","v1.5.2a1","v1.5.2a2","v1.5.2b1","v1.5.2b2","v1.5.2c1","v1.5a1","v1.5a2","v1.5a3","v1.5a4","v1.5b1","v1.5b2","v1.6a1","v1.6a2","v2.0","v2.0b1","v2.0b2","v2.0c1","v2.1","v2.1a1","v2.1a2","v2.1b1","v2.1b2","v2.1c1","v2.1c2","v2.2a3","v2.3c1","v2.3c2","v2.4","v2.4a1","v2.4a2","v2.4a3","v2.4b1","v2.4b2","v2.4c1","v2.5","v2.5.1","v2.5.1c1","v2.5.2","v2.5.2c1","v2.5.3","v2.5.3c1","v2.5.4","v2.5.5","v2.5.5c1","v2.5.5c2","v2.5.6","v2.5.6c1","v2.5a0","v2.5a1","v2.5a2","v2.5b1","v2.5b2","v2.5b3","v2.5c1","v2.5c2","v2.6","v2.6.1","v2.6.2","v2.6.2c1","v2.6.3","v2.6.3rc1","v2.6.4","v2.6.4rc1","v2.6.4rc2","v2.6.5","v2.6.5rc1","v2.6.5rc2","v2.6.6","v2.6.6rc1","v2.6.6rc2","v2.6.7","v2.6.8","v2.6.8rc1","v2.6.8rc2","v2.6a1","v2.6a2","v2.6a3","v2.6b1","v2.6b2","v2.6b3","v2.6rc1","v2.6rc2","v2.7","v2.7.1","v2.7.1rc1","v2.7.2","v2.7.2rc1","v2.7.3","v2.7.3rc1","v2.7.3rc2","v2.7.4rc1","v2.7a1","v2.7a2","v2.7a3","v2.7a4","v2.7b1","v2.7b2","v2.7rc1","v2.7rc2","v3.0a1","v3.0a2","v3.0a3","v3.0a4","v3.0a5","v3.0b1","v3.0b2","v3.0b3","v3.0rc1","v3.0rc2","v3.0rc3","v3.1","v3.1.1","v3.1.1rc1","v3.1.2","v3.1.2rc1","v3.1.3","v3.1.3rc1","v3.1.4","v3.1.4rc1","v3.1.5","v3.1.5rc1","v3.1.5rc2","v3.1a1","v3.1a2","v3.1b1","v3.1rc1","v3.1rc2","v3.2","v3.2.1","v3.2.1b1","v3.2.1rc1","v3.2.1rc2","v3.2.2","v3.2.2rc1","v3.2.3","v3.2.3rc1","v3.2.3rc2","v3.2.4","v3.2.4rc1","v3.2.5","v3.2.6","v3.2.6rc1","v3.2a1","v3.2a2","v3.2a3","v3.2a4","v3.2b1","v3.2b2","v3.2rc1","v3.2rc2","v3.2rc3","v3.3.0","v3.3.0a1","v3.3.0a2","v3.3.0a3","v3.3.0a4","v3.3.0b1","v3.3.0b2","v3.3.0rc1","v3.3.0rc2","v3.3.0rc3","v3.3.1","v3.3.1rc1","v3.3.2","v3.3.3","v3.3.3rc1","v3.3.3rc2","v3.3.4","v3.3.4rc1","v3.3.5","v3.3.5rc1","v3.3.5rc2","v3.3.6","v3.3.6rc1","v3.4.0","v3.4.0a1","v3.4.0a2","v3.4.0a3","v3.4.0a4","v3.4.0b1","v3.4.0b2","v3.4.0b3","v3.4.0rc1","v3.4.0rc2","v3.4.0rc3","v3.4.1","v3.4.1rc1","v3.4.2","v3.4.2rc1","v3.4.3","v3.4.3rc1","v3.4.4","v3.4.4rc1","v3.4.5","v3.4.5rc1","v3.4.6","v3.4.6rc1","v3.5.0","v3.5.0a1","v3.5.0a2","v3.5.0a3","v3.5.0a4","v3.5.0b1","v3.5.0b2","v3.5.0b3","v3.5.0b4","v3.5.0rc1","v3.5.0rc2","v3.5.0rc3","v3.5.0rc4","v3.5.1","v3.5.1rc1","v3.5.2","v3.5.2rc1","v3.5.3","v3.5.3rc1","v3.6.0","v3.6.0a1","v3.6.0a2","v3.6.0a3","v3.6.0a4","v3.6.0b1","v3.6.0b2","v3.6.0b3","v3.6.0b4","v3.6.0rc1","v3.6.0rc2"],"database_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://github.com/python/cpython/commit/e46f1c19642ea1882f427d8246987ba49351a97d","target":{"file":"Modules/_winapi.c"},"deprecated":false,"digest":{"line_hashes":["218842742840528232984843098097385860803","127454477101569755916249319287056794921","20429125633272882989296568068623439420","175029399360904081049491440687274254856","102429112281530730491428653102180443833","235585304500131722968505286982983450913","162421586083203872780226230748072803087","322346074756910611045843287168821985595","328934268040220999174264523524934004828","122425621509252423320561831842266390004","203520908918794314001852797621283172059","24063307871767707908639706257172603118","256539409247677939625131390922304092346"],"threshold":0.9},"id":"PSF-2017-8-0333f382","signature_type":"Line"},{"target":{"file":"Objects/abstract.c","function":"_PySequence_BytesToCharpArray"},"deprecated":false,"digest":{"function_hash":"30913131539697961270645265071646127013","length":893},"id":"PSF-2017-8-14834195","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/a9b16cff35811f88cdfeb4f50758140dfff36ebc"},{"id":"PSF-2017-8-153f2540","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/d174d24a5d37d1516b885dc7c82f71ecd5930700","target":{"file":"Modules/_winapi.c","function":"getenvironment"},"deprecated":false,"digest":{"function_hash":"163841087312105237945717372487639270066","length":1769}},{"id":"PSF-2017-8-2a3a3114","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/e46f1c19642ea1882f427d8246987ba49351a97d","target":{"file":"Modules/_winapi.c","function":"getenvironment"},"deprecated":false,"digest":{"function_hash":"274320457853093996456460671601189504567","length":1643}},{"signature_version":"v1","source":"https://github.com/python/cpython/commit/d174d24a5d37d1516b885dc7c82f71ecd5930700","target":{"file":"Objects/abstract.c","function":"_PySequence_BytesToCharpArray"},"deprecated":false,"digest":{"function_hash":"30913131539697961270645265071646127013","length":893},"id":"PSF-2017-8-2df73dfc","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"163841087312105237945717372487639270066","length":1769},"id":"PSF-2017-8-32b40982","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/a7c0264735f46afab13771be4218d8eab0d7dc91","target":{"file":"Modules/_winapi.c","function":"getenvironment"}},{"digest":{"function_hash":"78152671741007759856191916681405485918","length":2456},"id":"PSF-2017-8-3ab40da0","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/9dda2caca8edc7ff1285f6b0d1c5279b51854b7d","target":{"file":"Modules/posixmodule.c","function":"posix_execve"},"deprecated":false},{"digest":{"function_hash":"163841087312105237945717372487639270066","length":1769},"id":"PSF-2017-8-66c22e2a","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/a9b16cff35811f88cdfeb4f50758140dfff36ebc","target":{"file":"Modules/_winapi.c","function":"getenvironment"},"deprecated":false},{"id":"PSF-2017-8-6d2254cb","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/9dda2caca8edc7ff1285f6b0d1c5279b51854b7d","target":{"file":"PC/_subprocess.c","function":"getenvironment"},"deprecated":false,"digest":{"function_hash":"98635316900031957423639086866097178428","length":1338}},{"id":"PSF-2017-8-74d52832","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/a7c0264735f46afab13771be4218d8eab0d7dc91","target":{"file":"Objects/abstract.c","function":"_PySequence_BytesToCharpArray"},"deprecated":false,"digest":{"function_hash":"30913131539697961270645265071646127013","length":893}},{"digest":{"line_hashes":["102540342922806165301247411116097768736","327653878775567698959402405123969540370","330034184141175745598210186983612057637","102478924343248121341316006303133974329"],"threshold":0.9},"id":"PSF-2017-8-76f6cb58","signature_type":"Line","signature_version":"v1","source":"https://github.com/python/cpython/commit/9dda2caca8edc7ff1285f6b0d1c5279b51854b7d","target":{"file":"Modules/posixmodule.c"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"271443658309875833233823170238814298578","length":1154},"id":"PSF-2017-8-8f61c352","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/d174d24a5d37d1516b885dc7c82f71ecd5930700","target":{"file":"Modules/_winapi.c","function":"_winapi_CreateProcess_impl"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/python/cpython/commit/a7c0264735f46afab13771be4218d8eab0d7dc91","target":{"file":"Modules/_winapi.c"},"deprecated":false,"digest":{"line_hashes":["218842742840528232984843098097385860803","127454477101569755916249319287056794921","20429125633272882989296568068623439420","175029399360904081049491440687274254856","322982551261231145703533718355618806180","5715242493435189744851281508693496242","132421803570913130466468661303708902001","305314381623352237756546632402239381075","102429112281530730491428653102180443833","235585304500131722968505286982983450913","162421586083203872780226230748072803087","322346074756910611045843287168821985595","328934268040220999174264523524934004828","122425621509252423320561831842266390004","203520908918794314001852797621283172059","24063307871767707908639706257172603118","256539409247677939625131390922304092346"],"threshold":0.9},"id":"PSF-2017-8-93f2b222"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/python/cpython/commit/a9b16cff35811f88cdfeb4f50758140dfff36ebc","target":{"file":"Modules/_winapi.c"},"deprecated":false,"digest":{"line_hashes":["218842742840528232984843098097385860803","127454477101569755916249319287056794921","20429125633272882989296568068623439420","175029399360904081049491440687274254856","322982551261231145703533718355618806180","5715242493435189744851281508693496242","132421803570913130466468661303708902001","305314381623352237756546632402239381075","102429112281530730491428653102180443833","235585304500131722968505286982983450913","162421586083203872780226230748072803087","322346074756910611045843287168821985595","328934268040220999174264523524934004828","122425621509252423320561831842266390004","203520908918794314001852797621283172059","24063307871767707908639706257172603118","256539409247677939625131390922304092346"],"threshold":0.9},"id":"PSF-2017-8-b1dc369c"},{"source":"https://github.com/python/cpython/commit/fe82c46327effc124ff166e1fa1e611579e1176b","target":{"file":"Modules/_winapi.c","function":"winapi_CreateProcess"},"deprecated":false,"digest":{"function_hash":"178112269804641033195573331268468744796","length":1286},"id":"PSF-2017-8-b408a13f","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"274320457853093996456460671601189504567","length":1643},"id":"PSF-2017-8-ba1bfca6","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/fe82c46327effc124ff166e1fa1e611579e1176b","target":{"file":"Modules/_winapi.c","function":"getenvironment"}},{"digest":{"function_hash":"271443658309875833233823170238814298578","length":1154},"id":"PSF-2017-8-c061b073","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/a9b16cff35811f88cdfeb4f50758140dfff36ebc","target":{"file":"Modules/_winapi.c","function":"_winapi_CreateProcess_impl"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/python/cpython/commit/a7c0264735f46afab13771be4218d8eab0d7dc91","target":{"file":"Objects/abstract.c"},"deprecated":false,"digest":{"line_hashes":["251540310814918476627921261599236964732","194540472000014089895627714907156536233","123706707309800781550557327471922798113","110400399947081594628525433924345817755","159725014419352665774122105555821831939"],"threshold":0.9},"id":"PSF-2017-8-c2e7e046"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/python/cpython/commit/e46f1c19642ea1882f427d8246987ba49351a97d","target":{"file":"Objects/abstract.c"},"deprecated":false,"digest":{"line_hashes":["251540310814918476627921261599236964732","194540472000014089895627714907156536233","123706707309800781550557327471922798113","110400399947081594628525433924345817755","159725014419352665774122105555821831939"],"threshold":0.9},"id":"PSF-2017-8-c4c8f41b"},{"target":{"file":"Objects/abstract.c"},"deprecated":false,"digest":{"line_hashes":["251540310814918476627921261599236964732","194540472000014089895627714907156536233","123706707309800781550557327471922798113","110400399947081594628525433924345817755","159725014419352665774122105555821831939"],"threshold":0.9},"id":"PSF-2017-8-d1f4fdc0","signature_type":"Line","signature_version":"v1","source":"https://github.com/python/cpython/commit/d174d24a5d37d1516b885dc7c82f71ecd5930700"},{"source":"https://github.com/python/cpython/commit/a9b16cff35811f88cdfeb4f50758140dfff36ebc","target":{"file":"Objects/abstract.c"},"deprecated":false,"digest":{"line_hashes":["251540310814918476627921261599236964732","194540472000014089895627714907156536233","123706707309800781550557327471922798113","110400399947081594628525433924345817755","159725014419352665774122105555821831939"],"threshold":0.9},"id":"PSF-2017-8-d7d012ca","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"75232125542263855095022747957556186587","length":813},"id":"PSF-2017-8-dfd04745","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/e46f1c19642ea1882f427d8246987ba49351a97d","target":{"function":"_PySequence_BytesToCharpArray","file":"Objects/abstract.c"}},{"digest":{"threshold":0.9,"line_hashes":["140509265018338425847735678999426810131","218617570820950613381923668138619619027","137798482213508415901271558218127462061","999930254766206484334640130488721873","160514812869696394708996493059964441464","160121508537454658001275089145564060923","296626333042940398404859631840414931953","340268483148912669996117275173288129394","104440046046311068801388360441218169714","163828546648281964830781286825091071650","89661042890824265561092683734164151093","107220778101649621183847482156425783221"]},"id":"PSF-2017-8-e0b2cea6","signature_type":"Line","signature_version":"v1","source":"https://github.com/python/cpython/commit/9dda2caca8edc7ff1285f6b0d1c5279b51854b7d","target":{"file":"PC/_subprocess.c"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/python/cpython/commit/fe82c46327effc124ff166e1fa1e611579e1176b","target":{"file":"Objects/abstract.c"},"deprecated":false,"digest":{"line_hashes":["251540310814918476627921261599236964732","194540472000014089895627714907156536233","123706707309800781550557327471922798113","110400399947081594628525433924345817755","159725014419352665774122105555821831939"],"threshold":0.9},"id":"PSF-2017-8-e7a5188b"},{"id":"PSF-2017-8-eb0ec15d","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/e46f1c19642ea1882f427d8246987ba49351a97d","target":{"file":"Modules/_winapi.c","function":"winapi_CreateProcess"},"deprecated":false,"digest":{"function_hash":"178112269804641033195573331268468744796","length":1286}},{"id":"PSF-2017-8-ef59009d","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/fe82c46327effc124ff166e1fa1e611579e1176b","target":{"file":"Objects/abstract.c","function":"_PySequence_BytesToCharpArray"},"deprecated":false,"digest":{"function_hash":"30913131539697961270645265071646127013","length":893}},{"deprecated":false,"digest":{"line_hashes":["218842742840528232984843098097385860803","127454477101569755916249319287056794921","20429125633272882989296568068623439420","175029399360904081049491440687274254856","102429112281530730491428653102180443833","235585304500131722968505286982983450913","162421586083203872780226230748072803087","322346074756910611045843287168821985595","328934268040220999174264523524934004828","122425621509252423320561831842266390004","203520908918794314001852797621283172059","24063307871767707908639706257172603118","256539409247677939625131390922304092346"],"threshold":0.9},"id":"PSF-2017-8-f2d16c59","signature_type":"Line","signature_version":"v1","source":"https://github.com/python/cpython/commit/fe82c46327effc124ff166e1fa1e611579e1176b","target":{"file":"Modules/_winapi.c"}},{"signature_version":"v1","source":"https://github.com/python/cpython/commit/a7c0264735f46afab13771be4218d8eab0d7dc91","target":{"file":"Modules/_winapi.c","function":"_winapi_CreateProcess_impl"},"deprecated":false,"digest":{"function_hash":"271443658309875833233823170238814298578","length":1154},"id":"PSF-2017-8-f7ecbdfe","signature_type":"Function"},{"id":"PSF-2017-8-fcd9148b","signature_type":"Line","signature_version":"v1","source":"https://github.com/python/cpython/commit/d174d24a5d37d1516b885dc7c82f71ecd5930700","target":{"file":"Modules/_winapi.c"},"deprecated":false,"digest":{"line_hashes":["218842742840528232984843098097385860803","127454477101569755916249319287056794921","20429125633272882989296568068623439420","175029399360904081049491440687274254856","322982551261231145703533718355618806180","5715242493435189744851281508693496242","132421803570913130466468661303708902001","305314381623352237756546632402239381075","102429112281530730491428653102180443833","235585304500131722968505286982983450913","162421586083203872780226230748072803087","322346074756910611045843287168821985595","328934268040220999174264523524934004828","122425621509252423320561831842266390004","203520908918794314001852797621283172059","24063307871767707908639706257172603118","256539409247677939625131390922304092346"],"threshold":0.9}}],"source":"https://github.com/psf/advisory-database/blob/main/advisories/python/PSF-2017-8.json"}}],"schema_version":"1.7.3"}