PT-2024-12939 · Astropy+1 · Astropy+1

U32I · Published 2024-03-18 · Updated 2025-12-05 · CVE-2023-41334

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Astropy version 5.3.2

Description The issue is related to remote code execution due to improper input validation in the TranformGraph().to dot graph function. A malicious user can provide a command or a script file as a value to the savelayout argument, which will be placed as the first value in a list of arguments passed to subprocess.Popen. Although an error will be raised, the command or script will be executed successfully.

Recommendations For version 5.3.2, update to version 5.3.3 to fix the issue. As a temporary workaround, consider restricting the use of the TranformGraph().to dot graph function or limiting access to the savelayout argument to prevent exploitation.

Exploit

Fix

RCE

Special Elements Injection

Command Injection

Weakness Enumeration

CWE-74

CWE-77

Related Identifiers

CVE-2023-41334

DLA-3803-1

GHSA-H2X6-5JX5-46HF

MGASA-2024-0313

OPENSUSE-SU-2024:13797-1

Affected Products

Astropy

Debian

References · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41334.json · Exploit
• https://github.com/astropy/astropy/commit/22057d37b1313f5f5a9b5783df0a091d978dccb5 · Patch
• https://github.com/astropy/astropy/security/advisories/GHSA-h2x6-5jx5-46hf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-41334 · Security Note
• https://osv.dev/vulnerability/MGASA-2024-0313 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-41334 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/AFGTG4EH37DFBG66DWJ2DEZNIO44D3AX · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h2x6-5jx5-46hf · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-41334 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-41334 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-41334 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-41334 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2024-0313.html · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-41334 · Vendor Advisory
• https://github.com/astropy/astropy/blob/9b97d98802ee4f5350a62b681c35d8687ee81d91/astropy/coordinates/transformations.py#L539 · Note