bpo-42988: Remove the pydoc getfile feature (GH-25015)
authorMiss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Mon, 29 Mar 2021 13:08:00 +0000 (06:08 -0700)
committerRaspbian forward porter <root@raspbian.org>
Sat, 24 Jan 2026 09:41:14 +0000 (09:41 +0000)
commit61de7550ef30a43badafb727d42fec093a336c62
tree86343b225deb270d448d0de249569367f9bbf70d
parent69e01070fb0e7d029f5da870ea81f7d826d6848e
bpo-42988: Remove the pydoc getfile feature (GH-25015)

CVE-2021-3426: Remove the "getfile" feature of the pydoc module which
could be abused to read arbitrary files on the disk (directory
traversal vulnerability). Moreover, even source code of Python
modules can contain sensitive data like passwords. Vulnerability
reported by David Schwörer.
(cherry picked from commit 9b999479c0022edfc9835a8a1f06e046f3881048)

Co-authored-by: Victor Stinner <vstinner@python.org>
Gbp-Pq: Name 0003-bpo-42988-Remove-the-pydoc-getfile-feature-GH-25015.patch
Lib/pydoc.py
Lib/test/test_pydoc.py