PT-2020-14222 · Openai · Openapi-Python-Client

Dbanty + 2 · Published 2020-08-14 · Updated 2020-08-20 · CVE-2020-15142

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions openapi-python-client versions prior to 0.5.3

Description The issue allows clients generated with a maliciously crafted OpenAPI Document to generate arbitrary Python code, leading to arbitrary code execution when the malicious client is executed.

Recommendations For versions prior to 0.5.3, update to version 0.5.3 to resolve the issue. As a temporary workaround, consider inspecting OpenAPI documents before generating clients or inspecting generated code before executing it to minimize the risk of exploitation.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2020-15142

GHSA-9X4C-63PF-525F

PYSEC-2020-71

Affected Products

Openapi-Python-Client

References · 12

• https://github.com/triaxtec/openapi-python-client/commit/f7a56aae32cba823a77a84a1f10400799b19c19a · Patch
• https://osv.dev/vulnerability/GHSA-9x4c-63pf-525f · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15142 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2020-71 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15142 · Security Note
• https://github.com/triaxtec/openapi-python-client/security/advisories/GHSA-9x4c-63pf-525f · Note
• https://github.com/triaxtec/openapi-python-client/blob/main/CHANGELOG.md#053---2020-08-13 · Note
• https://github.com/openapi-generators/openapi-python-client/releases/tag/v.0.5.3 · Note
• https://github.com/openapi-generators/openapi-python-client/commit/f7a56aae32cba823a77a84a1f10400799b19c19a · Note
• https://github.com/openapi-generators/openapi-python-client · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/openapi-python-client/PYSEC-2020-71.yaml · Note
• https://pypi.org/project/openapi-python-client · Note