astropixie-widgets (>=0.1.0, <=0.1.2), autolens (0.1.2) +1 more potentially affected by CVE-2023-41334 via astropy (3.0.0)

astropy PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on astropy and may be impacted: - astropixie-widgets =0.1.0, =0.1.2 - autolens 0.1.2 - moons1d 0.2.4 Source cves: CVE-2023-41334 Source advisory: OSV:GHSA-H2X6-5JX5-46HF...

ugmrt-beamds (>=1.0.2, <=1.1.1) potentially affected by CVE-2023-41334 via astropy (4.3.0)

astropy PYPI version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on astropy and may be impacted: - ugmrt-beamds =1.0.2, =1.1.1 Source cves: CVE-2023-41334 Source advisory: OSV:GHSA-H2X6-5JX5-46HF...

mccd (1.1.0) potentially affected by CVE-2023-41334 via astropy (4.0.2)

astropy PYPI version 4.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on astropy and may be impacted: - mccd 1.1.0 Source cves: CVE-2023-41334 Source advisory: OSV:GHSA-H2X6-5JX5-46HF...

aimfast (>=1.3.0, <=1.3.3), aphos-openapi (>=2.5.0, <=2.5.3) +98 more potentially affected by CVE-2023-41334 via astropy (>=5.0.0rc2, <=5.3.2)

astropy PYPI version =5.0.0rc2, =1.3.0, =2.5.0, =0.0.3, =0.0.1, =0.0.2, =0.0.1, =1.3.3, =2021.10.14.1, =2021.10.14.1, =2021.10.14.1, =1.0.2, =2023.8.2, =2023.8.2.1 and more Source cves: CVE-2023-41334 Source advisory: OSV:GHSA-H2X6-5JX5-46HF...

sherlockpipe (>=0.12.1, <=0.13.2), tesslatte (>=0.1.11, <=0.1.19) potentially affected by CVE-2023-41334 via astropy (3.1.1)

astropy PYPI version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on astropy and may be impacted: - sherlockpipe =0.12.1, =0.1.11, =0.1.19 Source cves: CVE-2023-41334 Source advisory: OSV:GHSA-H2X6-5JX5-46HF...

CVE-2023-41334

Astropy is a project for astronomy in Python that fosters interoperability between Python astronomy packages. Version 5.3.2 of the Astropy core package is vulnerable to remote code execution due to improper input validation in the TranformGraph.todotgraph function. A malicious user can provide a...

CVE-2023-41334

Astropy is a project for astronomy in Python that fosters interoperability between Python astronomy packages. Version 5.3.2 of the Astropy core package is vulnerable to remote code execution due to improper input validation in the "TranformGraph.todotgraph" function. A malicious user can provide ...

CVE-2023-41334

CVE-2023-41334 affects Astropy core package version 5.3.2, with remote code execution due to improper input validation in TranformGraph().to_dot_graph. A crafted savelayout value can be injected into subprocess.Popen, causing the malicious command to execute despite an error. The issue is fixed i...

CVE-2023-41334 astropy vulnerable to RCE in TranformGraph().to_dot_graph function

Astropy is a project for astronomy in Python that fosters interoperability between Python astronomy packages. Version 5.3.2 of the Astropy core package is vulnerable to remote code execution due to improper input validation in the TranformGraph.todotgraph function. A malicious user can provide a...

CVE-2023-41334 astropy vulnerable to RCE in TranformGraph().to_dot_graph function

Astropy is a project for astronomy in Python that fosters interoperability between Python astronomy packages. Version 5.3.2 of the Astropy core package is vulnerable to remote code execution due to improper input validation in the TranformGraph.todotgraph function. A malicious user can provide a...

CVE-2023-41334 astropy vulnerable to RCE in TranformGraph().to_dot_graph function

Astropy is a project for astronomy in Python that fosters interoperability between Python astronomy packages. Version 5.3.2 of the Astropy core package is vulnerable to remote code execution due to improper input validation in the TranformGraph.todotgraph function. A malicious user can provide a...

aimapper (0.1.0), aimfast (>=0.1.0, <=1.3.3) +238 more potentially affected by CVE-2023-41334 via astropy (>=1.2.1, <=5.3.2)

astropy PYPI version =1.2.1, =0.1.0, =0.7.1a3, =2.5.0, =0.0.3, =0.0.1, =1.0.1, =0.3.0, =0.0.2, =1.0.0, =1.4.0 and more Source cves: CVE-2023-41334 Source advisory: MEND:CVE-2023-41334...

CVE-2023-41334

Astropy is a project for astronomy in Python that fosters interoperability between Python astronomy packages. Version 5.3.2 of the Astropy core package is vulnerable to remote code execution due to improper input validation in the TranformGraph.todotgraph function. A malicious user can provide a...

CVE-2023-41334: Improper Neutralization of Special Elements used in a Command

Astropy is a project for astronomy in Python that fosters interoperability between Python astronomy packages. Version 5.3.2 of the Astropy core package is vulnerable to remote code execution due to improper input validation in the TranformGraph.todotgraph function. A malicious user can provide a...

PT-2024-12939

Name of the Vulnerable Software and Affected Versions Astropy version 5.3.2 Description The issue is related to remote code execution due to improper input validation in the TranformGraph.to dot graph function. A malicious user can provide a command or a script file as a value to the savelayout...

Astropy Security Breach

Astropy is a Python astronomy project designed to promote interoperability between Python astronomy packages. A security vulnerability exists in Astropy version 5.3.2, which stems from an improper input validation issue in the function TranformGraph.todotgraph, leading to a remote code execution...

RCE via TranformGraph().to_dot_graph function

Description Due to improper input validation a malicious user can provide a command or a script file as a value to savelayout argument, which will be placed as the first value in a list of arguments passed to subprocess.Popen. Although an error will be raised, the command or script will be execut...