CVE-2019-12761: Code Injection in PyXDG
Summary
CVE-2019-12761: Code Injection in PyXDG. Affects pyxdg versions < 0.26. Fixed in 0.26. How to fix ↓
Also tracked for
- pyxdg · Debian:11
The same CVE-2019-12761 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PyXDG is a Python library that provides implementations of various specifications from the freedesktop.org project. It allows applications to easily access desktop-specific information, such as menus, icons, and configuration files. PyXDG is widely used in Linux desktop environments and applications. However, a code injection vulnerability has been discovered in PyXDG before version 0.26.
Vulnerability Detail
The code injection vulnerability in PyXDG exists due to a lack of sanitization in the xdg/Menu.py module before an eval call. An attacker can exploit this vulnerability by crafting Python code in a Category element of a Menu XML document in a .menu file. To trigger the parsing of the malicious code, the XDG_CONFIG_DIRS environment variable must be set up to include the directory containing the malicious .menu file. This vulnerability has a CVSS score of 7.5 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). The impact of this vulnerability can be severe, allowing an attacker to execute arbitrary code within the context of the application using PyXDG.
How To Fix
Minimum fixed version
0.26
This is the first release that contains the fix.
pip install --upgrade "pyxdg==0.26"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of PyXDG is not immediately possible, users can mitigate the risk by ensuring that the XDG_CONFIG_DIRS environment variable is not set to include untrusted directories. Additionally, it is recommended to review and validate any .menu files used by the application to ensure they do not contain malicious code.
Conclusion
The code injection vulnerability in PyXDG before version 0.26 can allow an attacker to execute arbitrary code within the context of the application. It is crucial to upgrade to the latest version of PyXDG to mitigate this vulnerability. If immediate upgrade is not possible, users should take precautions by avoiding untrusted directories in the XDG_CONFIG_DIRS environment variable and validating .menu files used by the application. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pyxdg →
FAQ
PyXDG is a Python library that provides implementations of various specifications from the freedesktop.org project. It allows applications to easily access desktop-specific information, such as menus, icons, and configuration files.
This vulnerability allows an attacker to execute arbitrary code within the context of the application using PyXDG. The impact can be severe, potentially leading to remote code execution or privilege escalation.
To fix this vulnerability, users should upgrade to PyXDG version 0.26 or later. This version includes the necessary sanitization to prevent code injection attacks.
If upgrading to the latest version is not immediately possible, users can mitigate the risk by ensuring that the XDG_CONFIG_DIRS environment variable is not set to include untrusted directories. Additionally, it is recommended to review and validate any .menu files used by the application.
Yes, this vulnerability has a CVSS score of 7.5 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
Related vulnerabilities
Recent vulnerabilities recorded for pyxdg.
