PT-2019-14821 · Github+1 · Codeql+1

Adityasharad · Published 2019-11-25 · Updated 2021-10-28 · CVE-2019-16765

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CodeQL extension versions prior to 1.0.1

Description The issue allows an attacker to execute arbitrary code on a user's system if the user opens a specially prepared directory tree as a workspace in Visual Studio Code with the CodeQL extension active.

Recommendations For versions prior to 1.0.1, upgrade to version 1.0.1 of the CodeQL extension using Visual Studio Code Marketplace's upgrade mechanism. After upgrading, ensure the codeQL.cli.executablePath setting is only set in the per-user settings.

Fix

Path traversal

Weakness Enumeration

CWE-22

CWE-250

Related Identifiers

CVE-2019-16765

GHSA-WF4X-8MPJ-R42Q

Affected Products

Codeql

Visual Studio Code

References · 5

• https://github.com/github/vscode-codeql/pull/174 · Patch
• https://osv.dev/vulnerability/CVE-2019-16765 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16765 · Security Note
• https://github.com/github/vscode-codeql/blob/v1.0.1/CHANGELOG.md · Note
• https://github.com/github/vscode-codeql/security/advisories/GHSA-wf4x-8mpj-r42q · Note