CVE-2020-15523: 
Python vulnerability analysis and mitigation

CVE-2020-15523 affects Python versions 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows systems. The vulnerability exists in cases where CPython is embedded in a native application, where a Trojan horse python3.dll might be used due to an invalid search path for python3.dll loading after Py_SetPath has been used. Importantly, this issue cannot occur when using python.exe from a standard (non-embedded) Python installation on Windows (CVE Mitre).

The vulnerability occurs during Py_Initialize() when the runtime attempts to pre-load python3.dll. If Py_SetPath() has been called, the expected location is not set, and locations elsewhere on the user's system will be searched. This happens because python3X.dll may use an invalid search path for python3.dll loading after Py_SetPath has been used (Python Bug Tracker).

The successful exploitation of this vulnerability could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS). The vulnerability has been assigned a CVSS score of 7.8 (HIGH) with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NetApp Advisory).

The vulnerability can be exploited by placing a malicious python3.dll in specific locations that would be searched by the embedded Python application. For example, if an attacker can inject code into vulnerable processes that embed Python by creating 'C:\DLLs\python3.dll', they could potentially gain system access when the application runs with administrator privileges (Python Bug Tracker).

Applications can mitigate the vulnerability by explicitly calling LoadLibrary() on their copy of python3.dll before calling Py_Initialize(). Even with the patch applied, applications should include a copy of python3.dll alongside their main Python DLL. The vulnerability has been fixed in Python versions 3.9.0b5, 3.8.4, 3.7.9 (source only), and 3.6.12 (source only) (Python Bug Tracker).