GHSA-8p42-7597-p2f6

Suggest an improvement
Source
https://github.com/advisories/GHSA-8p42-7597-p2f6
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-8p42-7597-p2f6/GHSA-8p42-7597-p2f6.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-8p42-7597-p2f6
Aliases
Published
2024-04-27T09:30:33Z
Modified
2024-04-30T08:42:02.569690Z
Severity
  • 6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
Summary
dcnnt-py is vulnerable to command injection via Notification Handler
Details

A vulnerability was found in cyanomiko dcnnt-py up to 0.9.0. It has been classified as critical. Affected is the function main of the file dcnnt/plugins/notifications.py of the component Notification Handler. The manipulation leads to command injection. It is possible to launch the attack remotely. Upgrading to version 0.9.1 is able to address this issue. The patch is identified as b4021d784a97e25151a5353aa763a741e9a148f5. It is recommended to upgrade the affected component. VDB-262230 is the identifier assigned to this vulnerability.

Database specific 
{
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-30T08:26:21Z",
    "nvd_published_at": "2024-04-27T09:15:08Z",
    "cwe_ids": [
        "CWE-77"
    ],
    "severity": "MODERATE"
}
References

Affected packages

PyPI / dcnnt

Package

Name
dcnnt
View open source insights on deps.dev
Purl
pkg:pypi/dcnnt

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.9.1

Affected versions

0.*

0.3.3
0.3.4
0.3.5
0.3.6
0.3.7
0.3.8
0.4.0
0.5.0
0.6.0
0.7.0
0.7.1
0.8.0
0.9.0

Database specific 

{
    "last_known_affected_version_range": "<= 0.9.0"
}