PT-2019-16623 · Pypi · Sqla Yaml Fixtures

Bigbigliang-Malwarebenchmark · Publicado 2019-01-03 · Atualizado 2019-01-31 · CVE-2019-3575

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Sqla yaml fixtures versions up to 0.9.1

Description The issue allows local users to execute arbitrary python code via the fixture text argument in the sqla yaml fixtures.load function. This can lead to code execution with the privileges of the user running the application.

Recommendations For Sqla yaml fixtures versions up to 0.9.1, consider restricting access to the sqla yaml fixtures.load function to minimize the risk of exploitation. As a temporary workaround, avoid using the fixture text argument in the sqla yaml fixtures.load function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2019-3575

GHSA-2X54-J4M3-R6WX

PYSEC-2019-122

Produtos afetados

Sqla Yaml Fixtures

Referências · 8

• 🔥 https://github.com/schettino72/sqla_yaml_fixtures/issues/20 · Exploit
• https://github.com/pypa/advisory-database/tree/main/vulns/sqla-yaml-fixtures/PYSEC-2019-122.yaml · Nota
• https://github.com/schettino72/sqla_yaml_fixtures · Nota
• https://github.com/advisories/GHSA-2x54-j4m3-r6wx · Nota
• https://osv.dev/vulnerability/GHSA-2x54-j4m3-r6wx · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-3575 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-3575 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2019-122 · Aviso do Fabricante