PT-2019-18684 · Debian+1 · Python-Rdflib-Tools+1

Publicado 2019-02-09 · Atualizado 2022-04-06 · CVE-2019-7653

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Debian python-rdflib-tools version 4.2.2-1

Description The issue allows code injection due to the CLI tools loading Python modules from the current working directory. This is because the "python -m" command looks in this directory, as shown with rdf2dot. The problem is specific to the use of the debian/scripts directory.

Recommendations For Debian python-rdflib-tools version 4.2.2-1, consider restricting access to the debian/scripts directory to minimize the risk of code injection until a fix is available. As a temporary workaround, avoid using the CLI tools from the current working directory.

Exploit

Correção

Uncontrolled Search Path Element

Enumeração de Fraquezas

CWE-427

Identificadores relacionados

CVE-2019-7653

DLA-1717-1

DLA-2861-1

USN-4535-1

Produtos afetados

Ubuntu

Python-Rdflib-Tools

Referências · 20

• 🔥 https://bugs.debian.org/921751 · Exploit
• https://lists.debian.org/debian-lts-announce/2021/12/msg00026.html · Nota
• https://ubuntu.com/security/notices/USN-4535-1 · Aviso do Fabricante
• https://lists.debian.org/debian-lts-announce/2019/03/msg00019.html · Nota
• https://osv.dev/vulnerability/DLA-1717-1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-7653 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2019-7653 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7653 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-7653 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2019-7653 · Aviso do Fabricante
• https://packages.debian.org/src:rdflib · Nota
• https://osv.dev/vulnerability/USN-4535-1 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/DLA-2861-1 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/source-package/rdflib · Aviso do Fabricante
• https://usn.ubuntu.com/4535-1 · Aviso do Fabricante