News for hackers. Stuff that matters.
Re:A bite of Python by mrswag on Thursday September 08, 2016 @08:15AM (#12452242)
It's in their threat model under 'Module injection':

> The mitigation is to maintain secure access permissions on all directories and package files in search path to ensure unprivileged users do not have write access to them.

Re:A bite of Python by viraptor on Thursday September 08, 2016 @08:24AM (#12452312)
Ok, I see. To be honest I read that as "keep your PYTHONPATH sane". I think that's a bit different from worrying about someone having write access to the source, but still related - point taken.
Re:A bite of Python by zwp on Thursday September 08, 2016 @09:17AM (#12452662)
CVE-2008-5983 (https://bugs.python.org/issue5753) "Untrusted search path vuln... prepends an empty string to sys.path when the argv[0] argument does not contain a path separator"

Check out the "yes"es in the "fixed" column in comment at https://bugs.python.org/msg85966