DEBIAN-CVE-2024-23346

Pymatgen (Python Materials Genomics) is an open-source Python library for materials analysis. A critical security vulnerability exists in the JonesFaithfulTransformation.from_transformation_str() method within the pymatgen library prior to version 2024.2.20. This method insecurely utilizes eval() for processing input, enabling execution of arbitrary code when parsing untrusted input. Version 2024.2.20 fixes this issue.

References

https://security-tracker.debian.org/tracker/CVE-2024-23346

Affected packages

Debian:12 / pymatgen

Package

Name: pymatgen
Purl: pkg:deb/debian/pymatgen?arch=source&distro=bookworm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2022.11.7+dfsg1-11+deb12u1

Affected versions

2022.*

2022.11.7+dfsg1-11

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-23346.json"

Debian:13 / pymatgen

Package

Name: pymatgen
Purl: pkg:deb/debian/pymatgen?arch=source&distro=trixie

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2024.1.27+dfsg1-6

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-23346.json"

Debian:14 / pymatgen

Package

Name: pymatgen
Purl: pkg:deb/debian/pymatgen?arch=source&distro=forky

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2024.1.27+dfsg1-6

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-23346.json"