Lucene search

K
mageiaGentoo FoundationMGASA-2024-0313
HistorySep 25, 2024 - 9:08 p.m.

Updated python-astropy packages fix security vulnerability

2024-09-2521:08:46
Gentoo Foundation
advisories.mageia.org
1
astropy
security vulnerability
remote code execution
input validation
transformgraph
to_dot_graph
subprocess.popen
cve-2023-41334
unix

CVSS3

8.4

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.7

Confidence

Low

Version 5.3.2 of the Astropy core package is vulnerable to remote code execution due to improper input validation in the TranformGraph().to_dot_graph function. A malicious user can provide a command or a script file as a value to the savelayout argument, which will be placed as the first value in a list of arguments passed to subprocess.Popen. Although an error will be raised, the command or script will be executed successfully. (CVE-2023-41334)

OSVersionArchitecturePackageVersionFilename
Mageia9noarchpython-astropy< 5.1.1-1.1python-astropy-5.1.1-1.1.mga9

CVSS3

8.4

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.7

Confidence

Low