CVE-2017-17522 — python: Command injection in Lib/webbrowser.py

Back Back to CVE browser

HIGH

python: Command injection in Lib/webbrowser.py

Published Dec 14, 2017

8.8

HIGH

CVSS 3.0

EPSS 3.60%

Description

Lib/webbrowser.py in Python through 3.6.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a software maintainer indicates that exploitation is impossible because the code relies on subprocess.Popen and the default shell=False setting

Affected products

Red Hat Enterprise Linux 5

python

Not affected
Red Hat Enterprise Linux 6

python

Not affected
Red Hat Enterprise Linux 7

python

Not affected
Red Hat Software Collections

python27-python

Not affected
Red Hat Software Collections

rh-python34-python

Not affected
Red Hat Software Collections

rh-python35-python

Not affected
Red Hat Software Collections

rh-python36-python

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 5	python	Not affected	n/a
Red Hat Enterprise Linux 6	python	Not affected	n/a
Red Hat Enterprise Linux 7	python	Not affected	n/a
Red Hat Software Collections	python27-python	Not affected	n/a
Red Hat Software Collections	rh-python34-python	Not affected	n/a
Red Hat Software Collections	rh-python35-python	Not affected	n/a
Red Hat Software Collections	rh-python36-python	Not affected	n/a

Remediation

Red Hat statement

As per upstream, "exploitation is impossible because the code relies on subprocess.Popen and the default shell=False setting". On testing it seems, upstream has correctly concluded the non-security nature of this bug.

Metrics

3.60% 0.03595

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.03595

Score over time

2021–2026

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (16 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	3.60% (0.03595)	89.07th	v5 (v2026.06.15)
Jun 15, 2026	3.60% (0.03595)	87.92th	v5 (v2026.06.15)
Mar 30, 2025	1.36% (0.01361)	78.38th	v4 (v2025.03.14)
Mar 29, 2025	3.71% (0.03712)	79.70th	v4 (v2025.03.14)
Jul 20, 2024	0.60% (0.00598)	78.64th	v3 (v2023.03.01)
Feb 8, 2024	0.60% (0.00598)	77.74th	v3 (v2023.03.01)
May 7, 2023	0.60% (0.00598)	75.23th	v3 (v2023.03.01)
Mar 7, 2023	0.64% (0.00643)	76.07th	v3 (v2023.03.01)
Mar 6, 2023	1.14% (0.01136)	59.45th	v2 (v2022.01.01)
Oct 18, 2022	1.14% (0.01136)	58.28th	v2 (v2022.01.01)
Apr 1, 2022	1.14% (0.01136)	56.27th	v2 (v2022.01.01)
Feb 4, 2022	1.14% (0.01136)	34.23th	v2 (v2022.01.01)
Feb 3, 2022	1.11% (0.01110)	29.52th	v1
Jan 6, 2022	1.11% (0.01110)	28.89th	v1
Sep 1, 2021	1.11% (0.01110)	66.78th	v1
Apr 14, 2021	1.11% (0.01110)	0.00th	v1

Weaknesses (2)

CWE-20

Improper Input Validation

CWE-74

References (7)

http://www.securityfocus.com/bid/102207
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://access.redhat.com/security/cve/CVE-2017-17522
Vendor Advisory
https://bugs.python.org/issue32367
x_refsource_MISC
https://bugzilla.redhat.com/show_bug.cgi?id=1526176
Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2017-17522
https://security-tracker.debian.org/tracker/CVE-2017-17522
x_refsource_MISCIssue TrackingThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2017-17522

Link	Providers	Tags
http://www.securityfocus.com/bid/102207		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://access.redhat.com/security/cve/CVE-2017-17522		Vendor Advisory
https://bugs.python.org/issue32367		x_refsource_MISC
https://bugzilla.redhat.com/show_bug.cgi?id=1526176		Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2017-17522
https://security-tracker.debian.org/tracker/CVE-2017-17522		x_refsource_MISCIssue TrackingThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2017-17522