PT-2021-22946 · Ops Cli · Ops Cli

Published 2021-10-15 · Updated 2022-05-24 · CVE-2021-40720

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Ops CLI versions 2.0.4 and earlier

Description The issue is related to Deserialization of Untrusted Data, allowing arbitrary code execution when the checkout repo function is called on a maliciously crafted file. This enables an attacker to execute arbitrary code on the victim machine.

Recommendations For Ops CLI versions 2.0.4 and earlier, consider disabling the checkout repo function until a patch is available to prevent arbitrary code execution.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2021-40720

GHSA-X23Q-4J9J-9CXW

PYSEC-2021-380

Affected Products

Ops Cli

References · 7

• https://osv.dev/vulnerability/CVE-2021-40720 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x23q-4j9j-9cxw · Vendor Advisory
• https://helpx.adobe.com/security/products/ops_cli/apsb21-88.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40720 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-380 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/ops-cli/PYSEC-2021-380.yaml · Note
• https://github.com/adobe/ops-cli · Note