Lucene search

GitHub Advisory DatabaseGHSA-9X4C-63PF-525F

HistoryAug 20, 2020 - 2:38 p.m.

Arbitrary Code Generation

2020-08-2014:38:24

CWE-94

GitHub Advisory Database

github.com

6 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

9 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

0.002 Low

EPSS

Percentile

54.0%

JSON

Impact

Clients generated with a maliciously crafted OpenAPI Document can generate arbitrary Python code. Subsequent execution of this malicious client is arbitrary code execution.

Giving this a CVSS of 8.0 (high) with CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:P/RL:U/RC:C .

Patches

Fix will be included in version 0.5.3

Workarounds

Inspect OpenAPI documents before generating, or inspect generated code before executing.

For more information

If you have any questions or comments about this advisory:

Open an issue in openapi-python-client
Email us at [email protected]

Affected configurations

Vulners

Node

openapi-python-client_projectopenapi-python-clientRange<0.5.3

CPENameOperatorVersion
openapi-python-clientlt0.5.3

CPE	Name	Operator	Version
	openapi-python-client	lt	0.5.3

References

github.com/advisories/GHSA-9x4c-63pf-525f

github.com/openapi-generators/openapi-python-client/commit/f7a56aae32cba823a77a84a1f10400799b19c19a

github.com/openapi-generators/openapi-python-client/releases/tag/v.0.5.3

github.com/triaxtec/openapi-python-client/blob/main/CHANGELOG.md#053---2020-08-13

github.com/triaxtec/openapi-python-client/commit/f7a56aae32cba823a77a84a1f10400799b19c19a

github.com/triaxtec/openapi-python-client/security/advisories/GHSA-9x4c-63pf-525f

nvd.nist.gov/vuln/detail/CVE-2020-15142

pypi.org/project/openapi-python-client/

6 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

9 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

0.002 Low

EPSS

Percentile

54.0%

JSON

Related for GHSA-9X4C-63PF-525F