CVE-2022-21187: Command Injection in libvcs Package
Summary
CVE-2022-21187: The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. Affects libvcs versions < 0.11.1. Fixed in 0.11.1. How to fix ↓
Also tracked for
- vcspull · PyPI
The same CVE-2022-21187 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The libvcs package is a Python package available on PyPI that provides a simple interface for version control systems (VCS) like Git, Mercurial (hg), and Subversion (svn). It allows developers to interact with VCS repositories programmatically. The package is widely used in various Python projects for managing code repositories and performing VCS operations.
Vulnerability Detail
The libvcs package before version 0.11.1 is vulnerable to command injection due to argument injection. The vulnerability arises when calling the update_repo function with the hg (Mercurial) VCS. The url parameter passed to the hg clone command is not properly sanitized, allowing an attacker to inject arbitrary command options. By crafting a malicious URL with specially crafted options, an attacker can execute arbitrary commands on the system where the vulnerable code is running. This can lead to unauthorized access, data leakage, or even complete compromise of the affected system.
How To Fix
Minimum fixed version
0.11.1
This is the first release that contains the fix.
pip install --upgrade "libvcs==0.11.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is strongly advised to upgrade to the fixed version of the libvcs package as soon as possible.
Conclusion
The libvcs package before version 0.11.1 is vulnerable to command injection, allowing an attacker to execute arbitrary commands on the system. It is crucial to upgrade to version 0.11.1 or later to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libvcs →
FAQ
This vulnerability allows an attacker to execute arbitrary commands on the system where the vulnerable code is running. Depending on the privileges of the affected process, this can lead to unauthorized access, data leakage, or complete compromise of the system.
At the time of this advisory, there are no known public exploits for this vulnerability. However, it is important to promptly apply the recommended fix to mitigate the risk.
No, only versions before 0.11.1 are affected by this vulnerability. It is recommended to upgrade to version 0.11.1 or later to address the issue.
Yes, this vulnerability can be exploited remotely if the affected code is exposed to untrusted input from external sources. It is crucial to update the libvcs package to the fixed version to prevent remote exploitation.
You can use Vulert, a vulnerability monitoring tool, to check if your application is affected by this vulnerability. Vulert analyzes your Pipfile.lock file and provides real-time alerts for open-source vulnerabilities. Visit the Vulert playground at Vulert Scanner to check if your application is affected without any signup or installation.
