PT-2022-12432 · Freecad+1 · Freecad+1

Eldstal · Published 2022-01-25 · Updated 2022-10-27 · CVE-2021-45844

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FreeCAD version 0.19

Description The issue is related to improper sanitization in the invocation of ODA File Converter from FreeCAD, allowing an attacker to inject OS commands via a crafted filename.

Recommendations For FreeCAD version 0.19, consider disabling the invocation of ODA File Converter until a patch is available to prevent OS command injection via crafted filenames.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2021-45844

DLA-2934-1

DLA-3076-1

DSA-5229-1

MGASA-2022-0325

Affected Products

Freecad

Oda File Converter

References · 22

• 🔥 https://forum.freecadweb.org/viewtopic.php?t=64733 · Exploit
• 🔥 https://tracker.freecad.org/view.php?id=4809 · Exploit
• https://advisories.mageia.org/MGASA-2022-0325.html · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-45844 · Vendor Advisory
• https://debian.org/lts/security/2022/dla-2934 · Vendor Advisory
• https://debian.org/lts/security/2022/dla-3076 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5229-1 · Vendor Advisory
• https://debian.org/security/2022/dsa-5229 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45844 · Security Note
• https://osv.dev/vulnerability/DLA-2934-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2022-0325 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-45844 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-45844 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-45844 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-45844 · Vendor Advisory