CPython bugs & risky features
- Room:
- The Auditorium
- Start (Dublin time):
- Start (your time):
- Duration:
- 45 minutes
Abstract
In this talk we will look into a few bug cases or doubtful features in CPython some of which are still present (and known to bugs.python.org) and may impose a security risk for admins or organizations.
Talk~None of the above
Description
In this talk we will look into a few bug cases or doubtful features in CPython some of which are still present (and known to bugs.python.org) and may impose a security risk for admins or organizations.
We will learn why running Python interpreter in random directory can be harmful which is related to interpreter libs loading, a possibility for installed modules to inject code into any Python script execution (even if the installed library is not imported), a socket.inet_aton issue that actually comes from glibc and risks involved with those cases and possible mitigations of those risks.
@EDIT After talk:
- Watch the talk on https://youtu.be/tRtxCCRdZOs?t=12251
- Slides are available on https://ujeb.se/pybugs