GitHub Advisoryadvisory · PyPI

GHSA-jhjh-ghwx-6h7r modulemd uses an unsafe function for processing externally provided data

CRITICAL Published 2019-01-17 Modified 2024-09-24 Official page ↗

Aliases: CVE-2017-1002157
Ecosystem: PyPI
Packages: modulemd
Severity: Critical
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-20, CWE-242
Reviewed: 2020-06-16

Affected packages

• PyPI modulemd: < 1.3.2 → fixed in 1.3.2

Description

modulemd 1.3.1 and earlier uses an unsafe function for processing externally provided data, leading to remote code execution.

Related

Alias · CVE (1)

CVE-2017-1002157 modulemd 1.3.1 and earlier uses an unsafe function for processing externally provided data, leading to remote code execution. vulnerability

Weakness · CWE (2)

CWE-20 Improper Input Validation weakness
CWE-242 Use of Inherently Dangerous Function weakness

References