THE NEWSGHOST, NIGERIA – In what has been described as its third-largest Patch Tuesday, Microsoft has released updates for its Python extension for Visual Studio Code(VS Code), its popular open-source, cross-platform code editor.
Patch Tuesday is an unofficial term used to refer to when Microsoft regularly releases software patches for its software products.
The company released the updates on Tuesday, May 12, along with updates for 12 different products, including Edge, Windows and .NET Framework.
With the latest update to the Python extension, it is now easier to select or change a Python interpreter path in a file system. This also offers an option to manually enter a file path in VS Code.
The update also includes fixes for two critical security flaws, Microsoft disclosed.
First is the remote code execution bug, tracked as CVE-2020-1192, which is exposed when Microsoft’s VS Code Python extension loads workspace settings from a file from a notebook, such as Jupyter. According to report, an attacker who duped a user to open a specially crafted file in VS Code with the Python extension installed could run malware on the machine.
Microsoft said it fixed this flaw by modifying the way VS Code Python extension enforces user settings.
The second security flaw is said to affect VS Code when the Python extension loads configuration files after opening a project.
‘An attacker would need to convince a target to clone a repository and open it in Visual Studio Code with the Python extension installed. Attacker-specified code would execute when the target opened the integrated terminal,’ the company explained.
Issues affecting Python in VS Code when running multiple cells in Notebook and Interactive Window using ipwidgets also got a fix.