PT-2019-15752 · Supybot+1 · Supybot+1

B1Tninja · Published 2019-11-16 · Updated 2020-08-24 · CVE-2019-19010

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Limnoria versions prior to 2019.11.09 Supybot versions through 2018-05-09

Description The issue allows remote unprivileged attackers to disclose information or possibly have unspecified other impact. This is achieved via the calc and icalc IRC commands in the Math plugin.

Recommendations For Limnoria versions prior to 2019.11.09, update to version 2019.11.09 or later. For Supybot versions through 2018-05-09, consider disabling the Math plugin until a patch is available. As a temporary workaround, restrict access to the calc and icalc IRC commands to minimize the risk of exploitation.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2019-19010

GHSA-6G88-VR3V-76MF

PYSEC-2019-102

Affected Products

Limnoria

Supybot

References · 20

• https://github.com/ProgVal/Limnoria/wiki/math-eval-vulnerability · Patch
• https://github.com/ProgVal/Limnoria/commit/3848ae78de45b35c029cc333963d436b9d2f0a35 · Patch
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/5P2AGND54UIJV3WHOYO2YINIXSDGAAPO · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5P2AGND54UIJV3WHOYO2YINIXSDGAAPO · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-19010 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/DRNOUHFEN75QAIKT4Y3HDN3TT5LSIWN2 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/54CQM2TEXRADLE77VOMCPHL5PBHR3ZWJ · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-19010 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19010 · Security Note
• https://osv.dev/vulnerability/PYSEC-2019-102 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-19010 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DRNOUHFEN75QAIKT4Y3HDN3TT5LSIWN2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-19010 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-19010 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-19010 · Security Note