bpo-42988: Remove the pydoc getfile feature (GH-25015)
authorMiss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Mon, 29 Mar 2021 13:08:00 +0000 (06:08 -0700)
committerArnaud Rebillout <arnaudr@debian.org>
Tue, 14 Apr 2026 04:38:32 +0000 (11:38 +0700)
commit80a287d045b180889597a15d75070221be66aecc
treee53f199906ebb1ffb2eb97a3326f3674e8dfcf41
parent7217ee01660b826e209415972a04e9cb3461a95d
bpo-42988: Remove the pydoc getfile feature (GH-25015)

CVE-2021-3426: Remove the "getfile" feature of the pydoc module which
could be abused to read arbitrary files on the disk (directory
traversal vulnerability). Moreover, even source code of Python
modules can contain sensitive data like passwords. Vulnerability
reported by David Schwörer.
(cherry picked from commit 9b999479c0022edfc9835a8a1f06e046f3881048)

Co-authored-by: Victor Stinner <vstinner@python.org>
Gbp-Pq: Name 0003-bpo-42988-Remove-the-pydoc-getfile-feature-GH-25015.patch
Lib/pydoc.py
Lib/test/test_pydoc.py