PT-2019-15752 · Supybot+1 · Supybot+1

B1Tninja · Publicado 2019-11-16 · Atualizado 2020-08-24 · CVE-2019-19010

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Limnoria versions prior to 2019.11.09 Supybot versions through 2018-05-09

Description The issue allows remote unprivileged attackers to disclose information or possibly have unspecified other impact. This is achieved via the calc and icalc IRC commands in the Math plugin.

Recommendations For Limnoria versions prior to 2019.11.09, update to version 2019.11.09 or later. For Supybot versions through 2018-05-09, consider disabling the Math plugin until a patch is available. As a temporary workaround, restrict access to the calc and icalc IRC commands to minimize the risk of exploitation.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2019-19010

GHSA-6G88-VR3V-76MF

PYSEC-2019-102

Produtos afetados

Limnoria

Supybot

Referências · 20

• https://github.com/ProgVal/Limnoria/wiki/math-eval-vulnerability · Correção
• https://github.com/ProgVal/Limnoria/commit/3848ae78de45b35c029cc333963d436b9d2f0a35 · Correção
• https://github.com/ProgVal/Limnoria · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/limnoria/PYSEC-2019-102.yaml · Nota
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/5P2AGND54UIJV3WHOYO2YINIXSDGAAPO · Aviso do Fabricante
• https://github.com/advisories/GHSA-6g88-vr3v-76mf · Nota
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5P2AGND54UIJV3WHOYO2YINIXSDGAAPO · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2019-19010 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/DRNOUHFEN75QAIKT4Y3HDN3TT5LSIWN2 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/54CQM2TEXRADLE77VOMCPHL5PBHR3ZWJ · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-19010 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-19010 · Nota de Segurança
• https://osv.dev/vulnerability/PYSEC-2019-102 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-19010 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DRNOUHFEN75QAIKT4Y3HDN3TT5LSIWN2 · Aviso do Fabricante