Insecure Defaults

Affecting khoros package, versions [,3.5.0)

Overview

khoros is an Useful tools and utilities to assist in managing a Khoros Community (formerly Lithium) environment.

Affected versions of this package are vulnerable to Insecure Defaults. An issue exists where the default value for the shell parameter to be False within py:func:khoros.utils.core_utils.run_cmd function. This is considered dangerous if user input flows into the run_cmd function.

Remediation

Upgrade khoros to version 3.5.0 or higher.

References

• GitHub Commit