GitHub Advisoryadvisory · PyPI

GHSA-h72c-w3q3-55qq OS Command Injection in jw.util

CRITICAL Published 2021-06-02 Modified 2023-03-03 Official page ↗
Aliases
CVE-2020-13388
Ecosystem
PyPI
Packages
jw.util
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
Reviewed
2021-05-14

Affected packages

• PyPI jw.util: < 2.3 → fixed in 2.3

Description

An exploitable vulnerability exists in the configuration-loading functionality of the jw.util package before 2.3 for Python. When loading a configuration with FromString or FromStream with YAML, one can execute arbitrary Python code, resulting in OS command execution, because safe_load is not used.

Related

Alias · CVE (1)

  • CVE-2020-13388 An exploitable vulnerability exists in the configuration-loading functionality of the jw.util package before 2.3 for Python. vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References