PT-2014-5409 · Google+2 · Luci+2

Published 2014-10-14 · Updated 2023-02-13 · CVE-2014-3593

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions luci version 0.26.0

Description The issue allows remote authenticated users with certain permissions to execute arbitrary Python code via a crafted cluster configuration.

Recommendations For luci version 0.26.0, update to a version that fixes the eval injection issue to prevent arbitrary Python code execution.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CESA-2014_1390

CVE-2014-3593

RHSA-2014:1390

RHSA-2014_1390

Affected Products

Centos

Red Hat

Luci

References · 11

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3593 · Security Note
• http://rhn.redhat.com/errata/RHSA-2014-1390.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-3593 · Security Note
• https://rhn.redhat.com/errata/RHSA-2014-1390.html · Note
• https://lists.centos.org/pipermail/centos-cr-announce/2014-October/014173.html · Note
• https://lists.centos.org/pipermail/centos-cr-announce/2014-October/027553.html · Note
• https://access.redhat.com/security/cve/CVE-2014-3593 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=989005 · Note
• https://access.redhat.com/errata/RHSA-2014:1390 · Note
• https://lists.centos.org/pipermail/centos-cr-announce/2014-October/007483.html · Note
• https://lists.centos.org/pipermail/centos-cr-announce/2014-October/020863.html · Note