PT-2022-20044 · Pypi · Python-Libnmap

Published 2022-05-04 · Updated 2024-08-03 · CVE-2022-30284

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions python-libnmap versions through 0.7.2

Description Remote command execution can occur in the python-libnmap package if used in a client application that does not validate arguments. The vendor believes it would be unrealistic for an application to call NmapProcess with arguments taken from input data that arrived over an untrusted network.

Recommendations For versions through 0.7.2, consider validating arguments before calling NmapProcess to prevent remote command execution. As a temporary workaround, restrict the use of NmapProcess to trusted input data until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

CVE-2022-30284

GHSA-QWQV-J7JR-4HP6

PYSEC-2022-42999

Affected Products

Python-Libnmap

References · 20

• 🔥 https://libnmap.readthedocs.io/en/latest/process.html#using-libnmap-process · Exploit
• 🔥 https://swascan.com/security-advisory-libnmap-2 · Exploit
• https://osv.dev/vulnerability/CVE-2022-30284 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-30284 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-30284 · Security Note
• https://osv.dev/vulnerability/GHSA-qwqv-j7jr-4hp6 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-42999 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-30284 · Security Note
• https://ubuntu.com/security/CVE-2022-30284 · Vendor Advisory
• https://github.com/savon-noir/python-libnmap/commit/c36fecde90017befeb4853396d0e2aac93c95b64 · Note
• https://github.com/savon-noir/python-libnmap · Note
• https://github.com/savon-noir/python-libnmap/releases/tag/v0.7.3 · Note
• https://github.com/savon-noir/python-libnmap/releases · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/python-libnmap/PYSEC-2022-42999.yaml · Note
• https://t.me/cibsecurity/41960 · Telegram Post