PT-2015-5213 · Python+1 · Python-Dbusmock+1

Simon Mcvittie · Published 2015-05-12 · Updated 2019-10-09 · CVE-2015-1326

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions python-dbusmock versions prior to 0.15.1

Description The issue allows an attacker to execute malicious code by supplying a .pyc file, potentially tricking the AddTemplate() D-Bus method call or the DBusTestCase.spawn server template() method into executing the malicious code.

Recommendations For versions prior to 0.15.1, update to version 0.15.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the AddTemplate() D-Bus method call and the DBusTestCase.spawn server template() method to minimize the risk of exploitation. Avoid using these methods with untrusted input until the issue is resolved.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2015-1326

GHSA-74XW-82V7-HMRM

PYSEC-2019-155

USN-2618-1

Affected Products

Ubuntu

Python-Dbusmock

References · 15

• https://github.com/martinpitt/python-dbusmock/commit/4e7d0df9093 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2015-1326 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2015-1326 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-1326 · Security Note
• https://ubuntu.com/security/CVE-2015-1326 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2019-155 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-74xw-82v7-hmrm · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2618-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-1326 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2015-1326 · Vendor Advisory
• https://osv.dev/vulnerability/USN-2618-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-1326 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/python-dbusmock/PYSEC-2019-155.yaml · Note
• https://github.com/martinpitt/python-dbusmock · Note
• https://github.com/advisories/GHSA-74xw-82v7-hmrm · Note