CVE-2020-15141: Path Traversal Vulnerability in openapi-python-client
Summary
CVE-2020-15141: In openapi-python-client before version 0.5.3, there is a path traversal vulnerability. Affects openapi-python-client across 2 version ranges.
< 0.5.3
< 3e7dfae5d0b3685abf1ede1bc6c086a116ac4746
Fixed in 3e7dfae5d0b3685abf1ede1bc6c086a116ac4746. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
openapi-python-client is a Python package available on PyPI that generates client libraries from OpenAPI specifications. It allows users to easily interact with APIs defined using the OpenAPI standard. The package is widely used in Python projects to automate the generation of API client code. However, a path traversal vulnerability has been discovered in versions prior to 0.5.3 of openapi-python-client.
Vulnerability Detail
The path traversal vulnerability in openapi-python-client allows an attacker to manipulate the generated files' location on disk by providing a maliciously crafted OpenAPI document. This can lead to arbitrary file placement on the system, potentially allowing an attacker to overwrite or create files in sensitive locations. The vulnerability poses a significant risk to the integrity and security of the affected system.
How To Fix
Minimum fixed version
3e7dfae5d0b3685abf1ede1bc6c086a116ac4746
This is the first release that contains the fix.
pip install --upgrade "openapi-python-client==3e7dfae5d0b3685abf1ede1bc6c086a116ac4746"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of openapi-python-client as soon as possible.
Conclusion
The path traversal vulnerability in openapi-python-client can be exploited by an attacker to manipulate the location of generated files on disk. This can lead to unauthorized access, data loss, or system compromise. It is highly recommended to upgrade to version 0.5.3 or later of openapi-python-client to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for openapi-python-client →
FAQ
openapi-python-client is a Python package that generates client libraries from OpenAPI specifications. It simplifies the process of interacting with APIs defined using the OpenAPI standard.
A path traversal vulnerability allows an attacker to access files or directories outside of the intended directory structure. In this case, the vulnerability in openapi-python-client allows an attacker to manipulate the location of generated files on disk.
The path traversal vulnerability in openapi-python-client can lead to arbitrary file placement on the system. This can be exploited by an attacker to overwrite or create files in sensitive locations, potentially leading to unauthorized access, data loss, or system compromise.
Yes, a fix is available for this vulnerability. Users should upgrade openapi-python-client to version 0.5.3 or later to mitigate the risk.
No, there are no known workarounds for this vulnerability. It is crucial to update to the fixed version of openapi-python-client.
References
Related vulnerabilities
Recent vulnerabilities recorded for openapi-python-client.
