Arbitrary Code Execution

2023-07-2808:36:35

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

arbitrary code execution

libopenbabel.so

groformat.cpp

vulnerability

input file parsing

readmolecule

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

23.3%

JSON

libopenbabel.so is vulnerable to Arbitrary Code Execution. The vulnerability exists when parsing an input file via ReadMolecule at groformat.cpp which allows an attacker to inject and execute arbitrary code using a specially crafted malformed file.

CPENameOperatorVersion
libopenbabel.sole7.0.0-3.1.1-18.el8.x86_64.debug
libopenbabel.sole7.0.0-3.1.1-18.el8.x86_64.debug

CPE	Name	Operator	Version
	libopenbabel.so	le	7.0.0-3.1.1-18.el8.x86_64.debug
	libopenbabel.so	le	7.0.0-3.1.1-18.el8.x86_64.debug

References

github.com/advisories/GHSA-h632-qvv7-2623

github.com/openbabel/openbabel/commit/71db0a942e5b736e6d386e78d0562a1d432df057#diff-8e7577a55d73e9fd513452500e3e8d8c94b691df9e932e8c918df30a8a52d11eR132

talosintelligence.com/vulnerability_reports/TALOS-2022-1668