PT-2007-1875 · Django · Django

Publicado 2007-01-23 · Atualizado 2022-05-01 · CVE-2007-0404

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Django version 0.95

Description The issue arises from the bin/compile-messages.py script in Django, which fails to properly quote argument strings before invoking the msgfmt program through the os.system function. This oversight allows attackers to execute arbitrary commands via shell metacharacters in a (1) .po or (2) .mo file.

Recommendations For Django version 0.95, consider modifying the bin/compile-messages.py script to properly quote argument strings before invoking the msgfmt program to prevent command execution via shell metacharacters. As a temporary workaround, restrict access to the bin/compile-messages.py script and avoid using it with untrusted .po or .mo files until a proper fix is applied.

Correção

Identificadores relacionados

CVE-2007-0404

GHSA-QC99-G3WM-HGXR

Produtos afetados

Django

Referências · 13

• https://github.com/django/django · Nota
• https://github.com/django/django/commit/a132d411c6986418ee6c0edc331080aa792fee6e · Nota
• https://github.com/django/django/commit/518d406e53 · Nota
• http://secunia.com/advisories/23826 · Aviso do Fabricante
• http://securityfocus.com/bid/22134 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-0404 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2007-0404 · Aviso do Fabricante
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=407519 · Nota
• https://security-tracker.debian.org/tracker/CVE-2007-0404 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-0404 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-qc99-g3wm-hgxr · Aviso do Fabricante
• http://code.djangoproject.com/changeset/3592 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31627 · Nota