CVE-2019-19010: Eval Injection in Supybot/Limnoria
Summary
CVE-2019-19010: Eval injection in Supybot/Limnoria. Affects limnoria versions < 2019.11.09. Fixed in 2019.11.09. How to fix ↓
Also tracked for
- limnoria · Debian:11
The same CVE-2019-19010 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Supybot/Limnoria is an open-source IRC bot written in Python. It provides a framework for creating and running IRC bots with various plugins. The Math plugin in Limnoria and Supybot allows users to perform mathematical calculations using IRC commands. However, versions before 2019.11.09 of Limnoria and versions through 2018-05-09 of Supybot are vulnerable to eval injection.
Vulnerability Detail
The eval injection vulnerability in the Math plugin of Limnoria and Supybot allows remote unprivileged attackers to disclose information or potentially have other unspecified impacts. This vulnerability can be exploited by sending malicious input to the calc and icalc IRC commands. The attacker can execute arbitrary code within the context of the bot, leading to information disclosure or potential further compromise.
How To Fix
Minimum fixed version
2019.11.09
This is the first release that contains the fix.
pip install --upgrade "limnoria==2019.11.09"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the affected packages to the latest secure versions.
Conclusion
The eval injection vulnerability in the Math plugin of Limnoria and Supybot can lead to information disclosure or potential further compromise. It is crucial to update the affected packages to the latest secure versions. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for limnoria →
FAQ
The vulnerability allows remote attackers to execute arbitrary code within the context of the IRC bot, potentially leading to information disclosure or further compromise.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
There are no known public exploits for this vulnerability at the time of writing. However, it is essential to update the affected packages to mitigate the risk.
Yes, this vulnerability can be exploited remotely by unprivileged attackers.
The CVSS score of this vulnerability is 9.8, indicating its critical severity.
Related vulnerabilities
Recent vulnerabilities recorded for limnoria.
