CVE-2022-30284: Argument injection in python-libnmap
Summary
CVE-2022-30284: Argument injection in python-libnmap. Affects python-libnmap versions < 0.7.3. Fixed in 0.7.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-libnmap is a Python package that provides a convenient interface to the Nmap security scanner. It allows users to programmatically interact with Nmap and retrieve scan results. The package is commonly used in client applications that require network scanning capabilities. However, versions up to 0.7.2 of python-libnmap are vulnerable to remote command execution if used in a client application that does not properly validate arguments.
Vulnerability Detail
The vulnerability in python-libnmap (CVE-2022-30284) arises from an argument injection issue. If the package is used in a client application that fails to validate user-supplied arguments, an attacker can exploit this vulnerability to execute arbitrary commands remotely. This can lead to unauthorized access, data breaches, and potential compromise of the host system. The vulnerability has a CVSS score of 9.8 (Critical) and is classified under CWE-88 (Argument Injection or Modification). The affected function in python-libnmap is libnmap.process.NmapProcess.get_command_line.
How To Fix
Minimum fixed version
0.7.3
This is the first release that contains the fix.
pip install --upgrade "python-libnmap==0.7.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to upgrade to the fixed version (0.7.3 or later) to mitigate the risk of remote command execution.
Conclusion
The argument injection vulnerability in python-libnmap (CVE-2022-30284) can lead to remote command execution and potential compromise of the host system. It is essential to upgrade to python-libnmap version 0.7.3 or later to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python-libnmap →
FAQ
python-libnmap is a Python package that provides an interface to the Nmap security scanner. It allows users to automate network scanning tasks and retrieve scan results programmatically.
The argument injection vulnerability in python-libnmap arises when user-supplied arguments are not properly validated in a client application. This allows an attacker to inject malicious commands and execute them remotely.
The vulnerability can lead to unauthorized remote command execution, which can result in unauthorized access, data breaches, and potential compromise of the host system.
Yes, a fix is available for this vulnerability. Users are advised to upgrade to python-libnmap version 0.7.3 or later to mitigate the risk of remote command execution.
No, there are no known workarounds for this vulnerability. It is crucial to upgrade to the fixed version of python-libnmap to address the issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-libnmap.
