Command injection in Gerapy

2021-05-0618:52:13

Google

osv.dev

0.002 Low

EPSS

Percentile

60.1%

JSON

This affects the package Gerapy from 0 and before 0.9.3. The input being passed to Popen, via the project_configure endpoint, isn’t being sanitized.

CPENameOperatorVersion
gerapyeq0.7.0
gerapyeq0.9.2
gerapyeq0.9.3b1
gerapyeq0.6.7
gerapyeq0.8.4rc2
gerapyeq0.7.7
gerapyeq0.8.1
gerapyeq0.8.7
gerapyeq0.7.2
gerapyeq0.6.8

Name	Operator	Version
gerapy	eq	0.7.0
gerapy	eq	0.9.2
gerapy	eq	0.9.3b1
gerapy	eq	0.6.7
gerapy	eq	0.8.4rc2
gerapy	eq	0.7.7
gerapy	eq	0.8.1
gerapy	eq	0.8.7
gerapy	eq	0.7.2
gerapy	eq	0.6.8

Rows per page:

1-10 of 351

References

github.com/Gerapy/Gerapy

github.com/Gerapy/Gerapy/commit/e8446605eb2424717418eae199ec7aad573da2d2

nvd.nist.gov/vuln/detail/CVE-2020-7698

snyk.io/vuln/SNYK-PYTHON-GERAPY-572470

0.002 Low

EPSS

Percentile

60.1%

JSON

Related for OSV:GHSA-G57J-Q48P-9VM2