PT-2005-2609 · Cheetah · Cheetah

Publicado 2005-05-17 · Atualizado 2022-05-01 · CVE-2005-1632

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cheetah versions 0.9.15 through 0.9.16

Description The issue allows local users to execute arbitrary code via a malicious module in the /tmp directory. This is possible because the software searches the /tmp directory for modules before using the paths in the PYTHONPATH variable.

Recommendations For versions 0.9.15 and 0.9.16, consider restricting access to the /tmp directory to prevent malicious modules from being executed. As a temporary workaround, avoid using the PYTHONPATH variable until a patch is available. Restrict the execution of arbitrary code by disabling the module search in the /tmp directory until the issue is resolved.

Correção

Uncontrolled Search Path Element

Enumeração de Fraquezas

CWE-427

Identificadores relacionados

CVE-2005-1632

GHSA-VXF2-7RC3-PXMX

Produtos afetados

Cheetah

Referências · 10

• https://github.com/cheetahtemplate/cheetah · Nota
• https://osv.dev/vulnerability/CVE-2005-1632 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2005-1632 · Aviso do Fabricante
• http://secunia.com/advisories/15386 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-1632 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2005-1632 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-vxf2-7rc3-pxmx · Aviso do Fabricante
• http://sourceforge.net/mailarchive/forum.php?thread_id=7070332&forum_id=1542 · Correção
• https://web.archive.org/web/20050430021153/http://sourceforge.net/mailarchive/forum.php?thread_id=7070332&forum_id=1542 · Nota
• http://osvdb.org/16622 · Nota