GHSA-vxf2-7rc3-pxmx

Source

https://github.com/advisories/GHSA-vxf2-7rc3-pxmx

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-vxf2-7rc3-pxmx/GHSA-vxf2-7rc3-pxmx.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-vxf2-7rc3-pxmx

Aliases

CVE-2005-1632

Published

2022-05-01T02:00:38Z

Modified

2023-11-08T03:56:45.678312Z

Summary

Cheetah Path Search Order Hijacking

Details

Cheetah 0.9.15 and 0.9.16 searches the /tmp directory for modules before using the paths in the PYTHONPATH variable, which allows local users to execute arbitrary code via a malicious module in /tmp/.

Database specific

{
    "nvd_published_at": "2005-05-17T04:00:00Z",
    "cwe_ids": [
        "CWE-427"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-09-18T23:34:20Z"
}

References

Affected packages

PyPI / cheetah

Package

Name: cheetah; View open source insights on deps.dev
Purl: pkg:pypi/cheetah

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0.9.15

Last affected

0.9.16