PT-2019-18684 · Debian+1 · Python-Rdflib-Tools+1

Published 2019-02-09 · Updated 2022-04-06 · CVE-2019-7653

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Debian python-rdflib-tools version 4.2.2-1

Description The issue allows code injection due to the CLI tools loading Python modules from the current working directory. This is because the "python -m" command looks in this directory, as shown with rdf2dot. The problem is specific to the use of the debian/scripts directory.

Recommendations For Debian python-rdflib-tools version 4.2.2-1, consider restricting access to the debian/scripts directory to minimize the risk of code injection until a fix is available. As a temporary workaround, avoid using the CLI tools from the current working directory.

Exploit

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2019-7653

DLA-1717-1

DLA-2861-1

USN-4535-1

Affected Products

Ubuntu

Python-Rdflib-Tools

References · 20

• 🔥 https://bugs.debian.org/921751 · Exploit
• https://ubuntu.com/security/notices/USN-4535-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1717-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-7653 · Security Note
• https://cve.org/CVERecord?id=CVE-2019-7653 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7653 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-7653 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-7653 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4535-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DLA-2861-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/rdflib · Vendor Advisory
• https://usn.ubuntu.com/4535-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2861-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-7653 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-7653 · Vendor Advisory