PT-2021-18188 · Gnuplot · Gnuplot

Published 2021-05-03 · Updated 2022-05-03 · CVE-2021-29369

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: gnuplot versions prior to 0.1.0

Description: The issue allows code execution via shell metacharacters in Gnuplot commands. This can be exploited by injecting malicious commands, potentially leading to unauthorized access or data compromise. The gnuplot package is used to draw charts and can be integrated with other tools like ps2pdf.

Recommendations: For versions prior to 0.1.0, update to version 0.1.0 or later to resolve the issue. As a temporary workaround, consider restricting the input to Gnuplot commands to prevent shell metacharacter injection until a patch is applied.

Fix

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

CVE-2021-29369

GHSA-F2JW-PR2C-9X96

Affected Products

Gnuplot

References · 6

• https://osv.dev/vulnerability/GHSA-f2jw-pr2c-9x96 · Vendor Advisory
• https://github.com/rkesters/gnuplot/commit/23671d4d3d28570fb19a936a6328bfac742410de · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-29369 · Security Note
• https://osv.dev/vulnerability/CVE-2021-29369 · Vendor Advisory
• https://npmjs.com/package/%40rkesters/gnuplot · Note
• https://npmjs.com/package/@rkesters/gnuplot · Note