PT-2021-22417 · Unknown · Nbgitpuller

Minrk · Published 2021-08-25 · Updated 2022-10-25 · CVE-2021-39160

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions nbgitpuller versions prior to 0.10.2

Description The issue arises due to unsanitized input, allowing arbitrary code execution in the user environment when visiting maliciously crafted links.

Recommendations For versions prior to 0.10.2, upgrade to version 0.10.2 or downgrade to 0.8.x to resolve the issue. As a temporary workaround for users who cannot upgrade, there are no available workarounds other than upgrading to 0.10.2 or downgrading to 0.8.x.

Fix

Code Injection

OS Command Injection

Weakness Enumeration

CWE-94

CWE-78

Related Identifiers

CVE-2021-39160

GHSA-MQ5P-2MCR-M52J

PYSEC-2021-315

Affected Products

Nbgitpuller

References · 9

• https://github.com/jupyterhub/nbgitpuller/commit/07690644f29a566011dd0d7ba14cae3eb0490481 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-39160 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-315 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mq5p-2mcr-m52j · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-39160 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/nbgitpuller/PYSEC-2021-315.yaml · Note
• https://github.com/jupyterhub/nbgitpuller/blob/main/CHANGELOG.md#0102---2021-08-25 · Note
• https://github.com/jupyterhub/nbgitpuller/security/advisories/GHSA-mq5p-2mcr-m52j · Note
• https://github.com/jupyterhub/nbgitpuller · Note