CVE-2019-7653 — Uncontrolled Search Path Element in Rdflib

CWE-427 — Uncontrolled Search Path Element9 documents6 sources
Severity
9.8CRITICALNVD
EPSS
1.0%
top 22.92%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Rdflib Project RdflibDebian RdflibCanonical Ubuntu Linux+1 more
Timeline
PublishedFeb 9
Latest updateMay 13

Description

The Debian python-rdflib-tools 4.2.2-1 package for RDFLib 4.2.2 has CLI tools that can load Python modules from the current working directory, allowing code injection, because "python -m" looks in this directory, as demonstrated by rdf2dot. This issue is specific to use of the debian/scripts directory.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages4 packages

▶debiandebian/rdflib< rdflib 4.2.2-2 (bookworm)
▶Debianrdflib_project/rdflib< 4.2.2-2+3
▶Ubunturdflib_project/rdflib< 4.1.2-3+deb8u1build0.16.04.1

Also affects: Debian Linux 8.0, 9.0, Ubuntu Linux 16.04

🔴Vulnerability Details

3
GHSA
GHSA-34gp-mhv2-cg2f: The Debian python-rdflib-tools 4↗2022-05-13
▶
OSV
rdflib vulnerability↗2020-09-23
▶
OSV
CVE-2019-7653: The Debian python-rdflib-tools 4↗2019-02-09
▶

📋Vendor Advisories

2
Ubuntu
RDFLib vulnerability↗2020-09-23
▶
Debian
CVE-2019-7653: rdflib - The Debian python-rdflib-tools 4.2.2-1 package for RDFLib 4.2.2 has CLI tools th...↗2019
▶

💬Community

3
Bugzilla
CVE-2019-7653 python-rdflib: Improper control of generation of code from current working directory [fedora-all]↗2019-02-12
▶
Bugzilla
CVE-2019-7653 python-rdflib: Improper control of generation of code from current working directory↗2019-02-12
▶
Bugzilla
CVE-2019-7653 python-rdflib: Improper control of generation of code from current working directory [epel-all]↗2019-02-12
▶
CVE-2019-7653 — Uncontrolled Search Path Element | cvebase