Vulnerability in unoconv package before 0.9
Summary
CVE-2019-17400: The unoconv package before 0.9 mishandles untrusted pathnames, leading to SSRF and local file inclusion. Affects unoconv across 2 version ranges.
< 0.7-2
< 4cf0e54460bf27db8153951a78b3860d4f810fea
Fixed in 0.7-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The unoconv package is a tool used for converting documents from one format to another. It is commonly used in various applications and environments to convert files such as documents, spreadsheets, and presentations. However, versions of unoconv before 0.9 are vulnerable to a security issue that mishandles untrusted pathnames, leading to Server-Side Request Forgery (SSRF) and local file inclusion.
Vulnerability Detail
The vulnerability in unoconv arises from its mishandling of untrusted pathnames. This can be exploited by an attacker to perform SSRF attacks, where they can make unauthorized requests to internal resources or services. Additionally, it can also lead to local file inclusion, allowing an attacker to include arbitrary files from the local system. These vulnerabilities can have serious ramifications, including unauthorized access to sensitive information, remote code execution, and potential compromise of the entire system.
How To Fix
Minimum fixed version
0.7-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade unoconvTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to update to the latest version of the unoconv package.
Conclusion
The unoconv package before version 0.9 is vulnerable to SSRF and local file inclusion attacks. It is crucial for users to update their installations to the latest version to mitigate these vulnerabilities and ensure the security of their systems. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for unoconv →
FAQ
Unoconv is a tool used for converting documents from one format to another. It is commonly used in various applications and environments.
Server-Side Request Forgery (SSRF) is a vulnerability that allows an attacker to make unauthorized requests to internal resources or services.
Local file inclusion is a vulnerability that allows an attacker to include arbitrary files from the local system.
The potential consequences of this vulnerability include unauthorized access to sensitive information, remote code execution, and potential compromise of the entire system.
To fix this vulnerability, it is recommended to update the unoconv package to version 0.9 or later.
Related vulnerabilities
Recent vulnerabilities recorded for unoconv.
