PT-2024-12939 · Astropy +1 · Astropy +1

U32I · Published 2024-03-18 · Updated 2024-09-25 · CVE-2023-41334

Positive Technologies · (AI Summary)

CVSS v3.1

8.4

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions:

Astropy version 5.3.2

Description:

The issue is related to remote code execution due to improper input validation in the `TranformGraph().to dot graph` function. A malicious user can provide a command or a script file as a value to the `savelayout` argument, which will be placed as the first value in a list of arguments passed to `subprocess.Popen`. Although an error will be raised, the command or script will be executed successfully.

Recommendations:

For version 5.3.2, update to version 5.3.3 to fix the issue. As a temporary workaround, consider restricting the use of the `TranformGraph().to dot graph` function or limiting access to the `savelayout` argument to prevent exploitation.

Fix

RCE

Special Elements Injection

Command Injection

Weakness Enumeration

CWE-74

CWE-77

Related Identifiers

CVE-2023-41334

DLA-3803-1

GHSA-H2X6-5JX5-46HF

MGASA-2024-0313

OPENSUSE-SU-2024:13797-1

Affected Products

Astropy

Debian

References · 22

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-41334 · Security Note
• https://security-tracker.debian.org/tracker/source-package/astropy · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-41334 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-41334 · Security Note
• https://ubuntu.com/security/CVE-2023-41334 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-41334 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h2x6-5jx5-46hf · Vendor Advisory
• https://advisories.mageia.org/MGASA-2024-0313.html · Security Note
• https://osv.dev/vulnerability/MGASA-2024-0313 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-41334 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/AFGTG4EH37DFBG66DWJ2DEZNIO44D3AX · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-41334 · Security Note
• https://github.com/astropy/astropy/security/advisories/GHSA-h2x6-5jx5-46hf · Note
• https://github.com/astropy/astropy/blob/9b97d98802ee4f5350a62b681c35d8687ee81d91/astropy/coordinates/transformations.py#L539 · Note
• https://github.com/astropy/astropy · Note