CVE-2020-15141: Path Traversal in openapi-python-client
Summary
CVE-2020-15141: Path Traversal in openapi-python-client. Affects openapi-python-client versions < 0.5.3. Fixed in 0.5.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The openapi-python-client package is an open-source tool used for generating Python clients from OpenAPI documents. It allows users to easily create client libraries for RESTful APIs. This package is available on PyPI (Python Package Index) and can be installed using pip. The vulnerability identified as CVE-2020-15141 is a path traversal vulnerability that affects the openapi-python-client package.
Vulnerability Detail
The path traversal vulnerability in openapi-python-client arises when a user generates a client using a maliciously crafted OpenAPI document. This vulnerability enables an attacker to manipulate the generated files and place them in arbitrary locations on the disk. The impact of this vulnerability is considered low, with a CVSS score of 3.0 (Low). The vulnerability can be exploited by an attacker with network access and low privileges. The attacker can potentially compromise the integrity and confidentiality of the system by placing files in unintended locations.
How To Fix
Minimum fixed version
0.5.3
This is the first release that contains the fix.
pip install --upgrade "openapi-python-client==0.5.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can inspect OpenAPI documents before generating clients for them. By carefully reviewing the OpenAPI document, users can identify any potential malicious content or path traversal attempts. It is recommended to validate the document against trusted sources and ensure its integrity before generating clients.
Conclusion
The path traversal vulnerability in openapi-python-client can be mitigated by updating the package to version 0.5.3 once it is released. In the meantime, users can follow the provided workaround to minimize the risk of exploitation. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for openapi-python-client →
FAQ
openapi-python-client is an open-source tool used for generating Python clients from OpenAPI documents. It simplifies the process of creating client libraries for RESTful APIs.
A path traversal vulnerability allows an attacker to access files or directories outside of the intended directory structure. In this case, the vulnerability enables an attacker to place generated files in arbitrary locations on the disk.
The impact of this vulnerability is considered low. However, it can potentially compromise the integrity and confidentiality of the system by placing files in unintended locations.
A fix for this vulnerability is being worked on and will be included in version 0.5.3 of the openapi-python-client package. Users are advised to update their package to the latest version once it is released.
Yes, users can inspect OpenAPI documents before generating clients for them. By carefully reviewing the OpenAPI document, users can identify any potential malicious content or path traversal attempts.
References
Related vulnerabilities
Recent vulnerabilities recorded for openapi-python-client.
