CVE-2019-7653

The Debian python-rdflib-tools 4.2.2-1 package for RDFLib 4.2.2 has CLI tools that can load Python modules from the current working directory, allowing code injection, because "python -m" looks in this directory, as demonstrated by rdf2dot. This issue is specific to use of the debian/scripts directory.

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://bugs.debian.org/921751	Exploit Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/03/msg00019.html	Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/12/msg00026.html	Mailing List Third Party Advisory
https://usn.ubuntu.com/4535-1/	Third Party Advisory
https://bugs.debian.org/921751	Exploit Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/03/msg00019.html	Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/12/msg00026.html	Mailing List Third Party Advisory
https://usn.ubuntu.com/4535-1/	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:rdflib_project:rdflib:4.2.2:*:*:*:*:*:*:*

Configuration 2 (hide)

OR	cpe:2.3:o:debian:debian_linux:8.0:::::::*
	cpe:2.3:o:debian:debian_linux:9.0:::::::*

Configuration 3 (hide)

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*

History

No history.

Information

Published : 2019-02-09 03:29

Updated : 2024-11-21 04:48

NVD link : CVE-2019-7653

Mitre link : CVE-2019-7653

CVE.ORG link : CVE-2019-7653

JSON object : View

Products Affected

rdflib_project

rdflib

canonical

ubuntu_linux

debian

debian_linux

CWE

CWE-427

Uncontrolled Search Path Element

{"id": "CVE-2019-7653", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2019-02-09T03:29:00.237", "references": [{"url": "https://bugs.debian.org/921751", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00019.html", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://lists.debian.org/debian-lts-announce/2021/12/msg00026.html", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://usn.ubuntu.com/4535-1/", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://bugs.debian.org/921751", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00019.html", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.debian.org/debian-lts-announce/2021/12/msg00026.html", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://usn.ubuntu.com/4535-1/", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-427"}]}], "descriptions": [{"lang": "en", "value": "The Debian python-rdflib-tools 4.2.2-1 package for RDFLib 4.2.2 has CLI tools that can load Python modules from the current working directory, allowing code injection, because \"python -m\" looks in this directory, as demonstrated by rdf2dot. This issue is specific to use of the debian/scripts directory."}, {"lang": "es", "value": "El paquete de Debian python-rdflib-tools 4.2.2-1 para RDFLib 4.2.2 tiene herramientas de la interfaz de l\u00ednea de comandos que pueden cargar m\u00f3dulos de Python desde el directorio de trabajo actual, lo que permite la inyecci\u00f3n de c\u00f3digo. Esto se debe a que \"python -m\" busca en este directorio, tal y como queda demostrado con rdf2dot. Este problema es espec\u00edfico del uso del directorio debian/scripts."}], "lastModified": "2024-11-21T04:48:28.067", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:rdflib_project:rdflib:4.2.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4ADFA040-AC41-4E37-B32A-0B063F4361C6"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"}, {"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*", "vulnerable": true, "matchCriteriaId": "7A5301BF-1402-4BE0-A0F8-69FBE79BC6D6"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}