CVE-2020-15142: openapi-python-client Arbitrary Code Execution
Summary
CVE-2020-15142: In openapi-python-client before version 0.5.3, clients generated with a maliciously crafted OpenAPI Document can generate arbitrary Python code. Affects openapi-python-client across 2 version ranges.
< 0.5.3
< f7a56aae32cba823a77a84a1f10400799b19c19a
Fixed in f7a56aae32cba823a77a84a1f10400799b19c19a. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
openapi-python-client is a Python package available on PyPI that generates client code from OpenAPI documents. It allows developers to easily interact with RESTful APIs by automatically generating Python code based on the API specification. This package is widely used in Python projects to streamline API integration.
Vulnerability Detail
A vulnerability exists in openapi-python-client before version 0.5.3, where clients generated with a maliciously crafted OpenAPI Document can generate arbitrary Python code. This means that an attacker can manipulate the OpenAPI Document to inject malicious code that will be executed when the generated client is used. The impact of this vulnerability is arbitrary code execution, which can lead to unauthorized access, data breaches, or other malicious activities.
How To Fix
Minimum fixed version
f7a56aae32cba823a77a84a1f10400799b19c19a
This is the first release that contains the fix.
pip install --upgrade "openapi-python-client==f7a56aae32cba823a77a84a1f10400799b19c19a"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of openapi-python-client to mitigate the risk of arbitrary code execution.
Conclusion
In conclusion, the openapi-python-client package before version 0.5.3 is vulnerable to arbitrary code execution. It is essential to update to the fixed version to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for openapi-python-client →
FAQ
openapi-python-client is a Python package that generates client code from OpenAPI documents, allowing developers to interact with RESTful APIs more easily.
The impact of this vulnerability is arbitrary code execution, which can lead to unauthorized access, data breaches, or other malicious activities.
To fix this vulnerability, update openapi-python-client to version 0.5.3 or later.
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of openapi-python-client.
You can find more information about this vulnerability in the advisory database of the Python Package Index (PyPI).
References
Related vulnerabilities
Recent vulnerabilities recorded for openapi-python-client.
