Do your applications use this vulnerable package?
Test your applications
Overview
pyxdg contains implementations of freedesktop.org standards in python.
Affected versions of this package are vulnerable to Arbitrary Command Execution
via the xdg.Menu.parse()
function. When it is possible to craft an evil menu
file with a Category
node containing Python injected code. Then it is possible to update xdg_config_dirs
with its location folder, the evil menu can be parsed and an attacker could exploit the vulnerability. This is due to a lack of sanitization in xdg/Menu.py
. When the evil menu
file is parsed, the injected code is executed because of an unsanitized eval()
.
Remediation
Upgrade pyxdg
to version 0.26 or higher.
References
CVSS Score
7.3
high severity
-
Attack VectorNetwork
-
Attack ComplexityLow
-
Privileges RequiredNone
-
User InteractionNone
-
ScopeUnchanged
-
ConfidentialityLow
-
IntegrityLow
-
AvailabilityLow
- Credit
- Alexandre D'Hondt
- CVE
- CVE-2019-12761
- CWE
- CWE-94
- Snyk ID
- SNYK-PYTHON-PYXDG-174562
- Disclosed
- 02 Feb, 2019
- Published
- 01 May, 2019