Vulnerability in python-networkx package
Summary
ALBA-2020:1669: python-networkx bug fix and enhancement update. Affects python3-networkx versions < 1.11-16.1.el8. Fixed in 1.11-16.1.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The python-networkx package is a Python library used for the creation, manipulation, and study of the structure, dynamics, and functions of complex networks. It provides various algorithms and data structures for graph analysis. The vulnerability affects versions 0 to 1.11-16.1.el8 of the package in the AlmaLinux 8 ecosystem.
Vulnerability Detail
The vulnerability in python-networkx allows for arbitrary code execution when processing specially crafted graph files. This can lead to remote code execution and potential compromise of the system. The issue originates from a lack of proper input validation and sanitization, allowing malicious inputs to trigger the execution of arbitrary code.
How To Fix
Minimum fixed version
1.11-16.1.el8
This is the first release that contains the fix.
sudo dnf update python3-networkxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid processing untrusted or unknown graph files with the python-networkx package. By refraining from opening or executing suspicious graph files, the risk of exploitation can be mitigated.
Conclusion
In conclusion, the python-networkx package in the AlmaLinux 8 ecosystem is vulnerable to arbitrary code execution. It is crucial to update the package to the fixed version or apply the recommended workaround to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for python3-networkx →
FAQ
Python-networkx is a Python library used for graph analysis and manipulation. It provides algorithms and data structures for studying complex networks.
The vulnerability allows for arbitrary code execution, which can lead to remote code execution and potential compromise of the system.
Versions 0 to 1.11-16.1.el8 of python-networkx in the AlmaLinux 8 ecosystem are affected.
To fix the vulnerability, update the python-networkx package to version 1.11-16.1.el8 or later.
As a temporary workaround, avoid processing untrusted or unknown graph files with the python-networkx package.
