PT-2020-17858 · Limdu · Limdu

Published 2020-06-22 · Updated 2020-06-30 · CVE-2020-4066

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Limdu versions prior to 0.95

Description The trainBatch function has a command injection vulnerability. Clients of the Limdu library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability.

Recommendations For versions prior to 0.95, update to version 0.95 to resolve the issue. As a temporary workaround, consider not using trainBatch with classifiers that rely on shell execution, such as SVM Perf, SVM Linear, or Adaboost.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2020-4066

GHSA-77QV-GH6F-PGH4

Affected Products

Limdu

References · 7

• https://github.com/erelsgl/limdu/security/advisories/GHSA-77qv-gh6f-pgh4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-4066 · Security Note
• https://osv.dev/vulnerability/CVE-2020-4066 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-77qv-gh6f-pgh4 · Vendor Advisory
• https://github.com/erelsgl/limdu/commit/03475a6a6bb253de6fad8f7f39cfb3504f11438d · Note
• https://github.com/erelsgl/limdu · Note
• https://t.me/cvenotify/4572 · Telegram Post