CVE-2019-19010
Eval injection in the Math plugin of Limnoria (before 2019.11.09) and ...
Severidad por fuente
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, GHSA.
Descripción
Eval injection in the Math plugin of Limnoria (before 2019.11.09) and Supybot (through 2018-05-09) allows remote unprivileged attackers to disclose information or possibly have unspecified other impact via the calc and icalc IRC commands.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| pip::GitHub Security Advisory pip | limnoria | 2019.11.09 |
| debian 10 | limnoria | 2019.02.23-1+deb10u1 |
| debian 11 | limnoria | 2019.11.09-1 |
| debian 12 | limnoria | 2019.11.09-1 |
| debian 13 | limnoria | 2019.11.09-1 |
| debian 14 | limnoria | 2019.11.09-1 |
| debian 9 | limnoria | 2017.01.10-1+deb9u1 |
| echo | limnoria | 2019.11.09-1 |
Referencias
- https://github.com/ProgVal/Limnoria
- https://github.com/ProgVal/Limnoria/commit/3848ae78de45b35c029cc333963d436b9d2f0a35
- https://github.com/ProgVal/Limnoria/wiki/math-eval-vulnerability
- https://github.com/advisories/GHSA-6g88-vr3v-76mf
- https://github.com/pypa/advisory-database/tree/main/vulns/limnoria/PYSEC-2019-102.yaml
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/54CQM2TEXRADLE77VOMCPHL5PBHR3ZWJ
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/54CQM2TEXRADLE77VOMCPHL5PBHR3ZWJ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5P2AGND54UIJV3WHOYO2YINIXSDGAAPO
Las 12 referencias
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5P2AGND54UIJV3WHOYO2YINIXSDGAAPO/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DRNOUHFEN75QAIKT4Y3HDN3TT5LSIWN2
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DRNOUHFEN75QAIKT4Y3HDN3TT5LSIWN2/
- https://nvd.nist.gov/vuln/detail/CVE-2019-19010