Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-38jr-29fh-w9vm

Опубликовано: 25 мар. 2024
Источник: github
Github: Прошло ревью
CVSS3: 7.4

Описание

ansys-geometry-core OS Command Injection vulnerability

subprocess call with shell=True identified, security issue.

Code

On file src/ansys/geometry/core/connection/product_instance.py:

403 def _start_program(args: List[str], local_env: Dict[str, str]) -> subprocess.Popen: 404 """ 405 Start the program where the path is the first item of the ``args`` array argument. 406 407 Parameters 408 ---------- 409 args : List[str] 410 List of arguments to be passed to the program. The first list's item shall 411 be the program path. 412 local_env : Dict[str,str] 413 Environment variables to be passed to the program. 414 415 Returns 416 ------- 417 subprocess.Popen 418 The subprocess object. 419 """ 420 return subprocess.Popen( 421 args, 422 shell=os.name != "nt", 423 stdin=subprocess.DEVNULL, 424 stdout=subprocess.DEVNULL, 425 stderr=subprocess.DEVNULL, 426 env=local_env, 427 ) 428 429

Upon calling this method _start_program directly, users could exploit its usage to perform malicious operations on the current machine where the script is ran. With this resolution made through #1076 and #1077, we make sure that this method is only called from within the library and we are no longer enabling the shell=True option.

CWE - 78

For more information see https://cwe.mitre.org/data/definitions/78.html

More information

Visit https://bandit.readthedocs.io/en/1.7.8/plugins/b602_subprocess_popen_with_shell_equals_true.html to find out more information.

Пакеты

Наименование

ansys-geometry-core

pip
Затронутые версииВерсия исправления

>= 0.3.0, < 0.3.3

0.3.3

Наименование

ansys-geometry-core

pip
Затронутые версииВерсия исправления

>= 0.4.0, < 0.4.12

0.4.12

EPSS

Процентиль: 31%
0.00118
Низкий

7.4 High

CVSS3

Дефекты

CWE-78

Связанные уязвимости

CVSS3: 7.4
nvd
почти 2 года назад

PyAnsys Geometry is a Python client library for the Ansys Geometry service and other CAD Ansys products. On file src/ansys/geometry/core/connection/product_instance.py, upon calling this method _start_program directly, users could exploit its usage to perform malicious operations on the current machine where the script is ran. This vulnerability is fixed in 0.3.3 and 0.4.12.

EPSS

Процентиль: 31%
0.00118
Низкий

7.4 High

CVSS3

Дефекты

CWE-78