Repository navigation
2.7.18.16: mimetypes reads C:\etc\mime.types etc. on Windows (CVE-2024-3220) - #98
Merged
Merged
Conversation
CVE-2024-3220) Backport of python/cpython pythongh-159428 (pythonGH-159445; the 3.10.22.1 port is f3c1882) to 2.7.18.x. mimetypes.init() reads the registry on Windows and then every file in knownfiles. Those are Unix paths ("/etc/mime.types", ...), which on Windows resolve to the root of the current drive (C:\etc\mime.types). Unprivileged users can usually create such files, and so could register arbitrary MIME types for every Python process on the machine, e.g. to change what SimpleHTTPServer serves a file as. knownfiles is now empty on Windows; only the registry is used by default. Callers can still pass files to init() or add to knownfiles themselves. 2.7.18.x: test_mimetypes empties mimetypes.knownfiles at import for isolation, so the test keeps a reference to the default list taken before that line; the non-Windows check lives in a new KnownfilesTestCase registered in test_main(). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ezequielp-activestate
approved these changes
Oct 28, 2026
ezequielp-activestate
left a comment
ezequielp-activestate
left a comment
There was a problem hiding this comment.
No blockers. The change is upstream's pythongh-159428 fix (04a29bf), line for line, and nothing has changed in Lib/mimetypes.py upstream since.
- Repro: importing
mimetypeswithsys.platformforced towin32gives the 9 Unix paths inknownfileson the base and[]on this branch. 2.7'sinit()still reads the registry first through_winreg, so the default Windows behaviour is registry-only, as upstream. - Tests: with this branch's
Lib/,test_mimetypes,test_urllib,test_urllib2,test_SimpleHTTPServerandtest_httpserverspass on Linux.
Not assessed: the Windows-only test, which needs a Windows build.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of python/cpython pythongh-159428 (CVE-2024-3220, PSF-2025-2) to 2.7.18.x. This is the same fix as in 3.10.22.1 (#87) and 3.9.25.1 (#88).
Problem: on Windows,
mimetypes.init()reads the registry and then every path inknownfiles. Those are Unix paths such as/etc/mime.types, which on Windows resolve to the root of the current drive (C:\etc\mime.types). Unprivileged users can usually create files there, so one user could change MIME types for every Python process on the machine.Fix:
knownfilesis empty on Windows, so only the registry is read by default. Explicitinit(files)calls still work.Tests:
Win32MimeTypesTestCase.test_default_knownfilesruns on Windows only.KnownfilesTestCase.test_default_knownfilesruns on other platforms.On Linux,
test_mimetypes,test_urllib,test_urllib2,test_SimpleHTTPServerandtest_httpserverspass. Forcingsys.platform = 'win32'before import,knownfilesgoes from 9 Unix paths to[]. The Windows-only test needs the Windows build of the rc.Part of 2.7.18.16. It targets the
2.7.18.16integration branch.