Vulnerability · Published May 22, 2020 · Assigned by mitre
CVE-2020-13388
Critical 9.8
In plain English
A critical-severity security flaw in the jw-util package (PyPI). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.5% (higher than 92% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)4.5%top 8.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An exploitable vulnerability exists in the configuration-loading functionality of the jw.util package before 2.3 for Python. When loading a configuration with FromString or FromStream with YAML, one can execute arbitrary Python code, resulting in OS command execution, because safe_load is not used.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | jw-util | 2.3 | GHSA-h72c-w3q3-55qq |
| PyPI | jw-util | 2.3 | PYSEC-2020-341 |
Affected products (as reported)
References
- https://joel-malwarebenchmark.github.io x_refsource_MISC
- https://joel-malwarebenchmark.github.io/blog/2020/04/27/cve-2020-13388-jw-util-vulnerability/ x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20200528-0002/ x_refsource_CONFIRM