CVE-2017-1002157: modulemd Remote Code Execution
Summary
CVE-2017-1002157: modulemd 1.3.1 and earlier uses an unsafe function for processing externally provided data, leading to remote code execution. Affects modulemd versions < 1.3.2. Fixed in 1.3.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
modulemd is a Python package available on PyPI that provides functionality for processing module metadata. It is commonly used in software development projects. However, versions 1.3.1 and earlier of modulemd contain a vulnerability that allows for remote code execution. This vulnerability arises from the use of an unsafe function when processing externally provided data.
Vulnerability Detail
The vulnerability in modulemd 1.3.1 and earlier can be exploited by an attacker to execute arbitrary code remotely. By providing specially crafted data, an attacker can trigger the unsafe function and gain unauthorized access to the system. This can lead to various consequences, including unauthorized data access, privilege escalation, and potential compromise of the entire system.
How To Fix
Minimum fixed version
1.3.2
This is the first release that contains the fix.
pip install --upgrade "modulemd==1.3.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The modulemd package versions 1.3.1 and earlier are vulnerable to remote code execution. Users should upgrade to version 1.3.2 or later to mitigate this risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for modulemd →
FAQ
modulemd is a Python package used for processing module metadata in software development projects.
Versions 1.3.1 and earlier of modulemd are affected by this vulnerability.
This vulnerability allows for remote code execution, potentially leading to unauthorized access, privilege escalation, and compromise of the system.
To fix this vulnerability, upgrade to version 1.3.2 or later of modulemd.
No specific workaround is mentioned for this vulnerability. It is recommended to update to the fixed version.
