PT-2015-7803 · Pygments+1 · Pygments+1

Stefan Cornelius · Publicado 2015-12-16 · Atualizado 2022-05-17 · CVE-2015-8557

Positive Technologies (AI Summary)

CVSS v4.0

9.5

Crítica

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Pygments versions 1.2.2 through 2.0.2

Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in a font name, specifically in the FontManager. get nix font path function in formatters/img.py.

Recommendations For Pygments versions 1.2.2 through 2.0.2, consider disabling the FontManager. get nix font path function until a patch is available to prevent the execution of arbitrary commands. Restrict access to the formatters/img.py module to minimize the risk of exploitation. Avoid using font names that contain shell metacharacters in the affected function until the issue is resolved.

Correção

RCE

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2015-8557

DLA-369-1

DSA-3445-1

GHSA-FFF8-4W9P-7V76

MGASA-2015-0478

PYSEC-2016-32

USN-2862-1

Produtos afetados

Pygments

Ubuntu

Referências · 29

• https://github.com/pygments/pygments · Nota
• https://github.com/pygments/pygments/commit/db6dd826f8624179e563aaded391efe824462f51 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/pygments/PYSEC-2016-32.yaml · Nota
• http://ubuntu.com/usn/USN-2862-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-fff8-4w9p-7v76 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2015/12/14/17 · Nota
• https://osv.dev/vulnerability/DSA-3445-1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-8557 · Nota de Segurança
• https://bitbucket.org/birkenfeld/pygments-main/pull-requests/501/fix-shell-injection-in/diff · Aviso do Fabricante
• https://security.gentoo.org/glsa/201612-05 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2016-32 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-2862-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2015-8557 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-2862-1 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=17331 · Nota