Vulnerability · Published Mar 18, 2024 · Assigned by GitHub_M
CVE-2023-41334astropy vulnerable to RCE in TranformGraph().to_dot_graph function
High 8.4
In plain English
A high-severity command injection in astropy from astropy. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 67% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Astropy is a project for astronomy in Python that fosters interoperability between Python astronomy packages. Version 5.3.2 of the Astropy core package is vulnerable to remote code execution due to improper input validation in the `TranformGraph().to_dot_graph` function. A malicious user can provide a command or a script file as a value to the `savelayout` argument, which will be placed as the first value in a list of arguments passed to `subprocess.Popen`. Although an error will be raised, the command or script will be executed successfully. Version 5.3.3 fixes this issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | astropy | no fix listed | DEBIAN-CVE-2023-41334 |
| Debian:13 | astropy | 5.3.3-1 | DEBIAN-CVE-2023-41334 |
| Debian:14 | astropy | 5.3.3-1 | DEBIAN-CVE-2023-41334 |
| PyPI | astropy | 5.3.3 | GHSA-h2x6-5jx5-46hf |
| PyPI | astropy | 5.3.3 | PYSEC-2026-1199 |
| Ubuntu:22.04:LTS | astropy | no fix listed | UBUNTU-CVE-2023-41334 |
Affected products (as reported)
Weakness: CWE-77 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/astropy/astropy/security/advisories/GHSA-h2x6-5jx5-46hf x_refsource_CONFIRM
- https://github.com/astropy/astropy/commit/22057d37b1313f5f5a9b5783df0a091d978dccb5 x_refsource_MISC
- https://github.com/astropy/astropy/blob/9b97d98802ee4f5350a62b681c35d8687ee81d91/astropy/coordinates/transformations.py#L539 x_refsource_MISC