PT-2015-7803 · Pygments+1 · Pygments+1

Stefan Cornelius · Published 2015-12-16 · Updated 2022-05-17 · CVE-2015-8557

Positive Technologies (AI Summary)

CVSS v4.0

9.5

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Pygments versions 1.2.2 through 2.0.2

Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in a font name, specifically in the FontManager. get nix font path function in formatters/img.py.

Recommendations For Pygments versions 1.2.2 through 2.0.2, consider disabling the FontManager. get nix font path function until a patch is available to prevent the execution of arbitrary commands. Restrict access to the formatters/img.py module to minimize the risk of exploitation. Avoid using font names that contain shell metacharacters in the affected function until the issue is resolved.

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2015-8557

DLA-369-1

DSA-3445-1

GHSA-FFF8-4W9P-7V76

MGASA-2015-0478

PYSEC-2016-32

USN-2862-1

Affected Products

Pygments

Ubuntu

References · 29

• http://ubuntu.com/usn/USN-2862-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fff8-4w9p-7v76 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3445-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-8557 · Security Note
• https://bitbucket.org/birkenfeld/pygments-main/pull-requests/501/fix-shell-injection-in/diff · Vendor Advisory
• https://security.gentoo.org/glsa/201612-05 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2016-32 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2862-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-8557 · Vendor Advisory
• https://osv.dev/vulnerability/USN-2862-1 · Vendor Advisory
• http://debian.org/security/2016/dsa-3445 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-8557 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2015-0478 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2015-8557 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-8557 · Vendor Advisory