CVE-2023-35932 jcvi vulnerable to Configuration Injection due to unsanitized user input

2023-06-2321:05:32

CWE-77

GitHub_M

www.cve.org

cve-2023-35932

configuration injection

python library

genome assembly

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

EPSS

0.001

Percentile

48.1%

JSON

jcvi is a Python library to facilitate genome assembly, annotation, and comparative genomics. A configuration injection happens when user input is considered by the application in an unsanitized format and can reach the configuration file. A malicious user may craft a special payload that may lead to a command injection. The impact of a configuration injection may vary. Under some conditions, it may lead to command injection if there is for instance shell code execution from the configuration file values. This vulnerability does not currently have a fix.

CNA Affected

[
  {
    "vendor": "tanghaibao",
    "product": "jcvi",
    "versions": [
      {
        "version": "<= 1.3.5",
        "status": "affected"
      }
    ]
  }
]