CVE-2019-17400: Server-Side Request Forgery in unoconv
Summary
CVE-2019-17400: Server-Side Request Forgery in unoconv. Affects unoconv versions < 0.9.0. Fixed in 0.9.0. How to fix ↓
Also tracked for
- unoconv · Debian:11
The same CVE-2019-17400 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The unoconv package is a Python library that provides a command-line tool for converting documents between different file formats. It is commonly used to convert files to and from various formats, such as PDF, DOCX, and ODT. unoconv is available on the Python Package Index (PyPI) and can be installed using pip. However, versions prior to 0.9 are vulnerable to a Server-Side Request Forgery (SSRF) and local file inclusion (LFI) issue.
Vulnerability Detail
The vulnerability in unoconv arises from mishandling untrusted pathnames. An attacker can exploit this flaw to perform SSRF attacks, where they can make the server send arbitrary requests to other internal or external resources. This can lead to unauthorized access to sensitive information, such as internal network resources or files on the server. Additionally, the vulnerability allows for local file inclusion, enabling an attacker to read arbitrary files on the server. The impact of this vulnerability is considered high, with a CVSS score of 7.5.
How To Fix
Minimum fixed version
0.9.0
This is the first release that contains the fix.
pip install --upgrade "unoconv==0.9.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The unoconv package prior to version 0.9 is vulnerable to a Server-Side Request Forgery (SSRF) and local file inclusion (LFI) issue. It is recommended to upgrade to version 0.9.0 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for unoconv →
FAQ
unoconv is a Python library and command-line tool used for converting documents between different file formats.
Server-Side Request Forgery (SSRF) is a vulnerability that allows an attacker to make a server send arbitrary requests to other internal or external resources.
Local File Inclusion (LFI) is a vulnerability that allows an attacker to read arbitrary files on a server.
The vulnerability in unoconv can lead to unauthorized access to sensitive information and files on the server.
To fix this vulnerability, upgrade to version 0.9.0 or later of the unoconv package.
References
Related vulnerabilities
Recent vulnerabilities recorded for unoconv.
