Command Injection Vulnerability in IPython Package
Summary
UBUNTU-CVE-2023-24816: IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Affects ipython versions 0.13.2-2 – 1.2.1-2ubuntu0.1~esm1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
IPython is an interactive command shell designed for computing in various programming languages, primarily Python. It provides a rich toolkit to help users with interactive computing, including features like dynamic introspection, rich media, and shell syntax. However, certain versions of IPython are vulnerable to a command injection issue that can be exploited under specific conditions.
Vulnerability Detail
The vulnerability arises from the function IPython.utils.terminal.set_term_title, which can be exploited in a Windows Python environment where the ctypes library is not available. This flaw allows an attacker to inject shell commands if untrusted input is passed to this function. The potential ramifications include unauthorized command execution within the scope of the current process, which could lead to further exploitation or data compromise.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading is not feasible, users should ensure that any calls to the IPython.utils.terminal.set_term_title function are made with trusted or filtered input to mitigate the risk of command injection.
Conclusion
The command injection vulnerability in IPython poses a risk to users who utilize the affected versions of the package. It is crucial to upgrade to the patched version to mitigate this risk. Users unable to upgrade should implement input validation as a temporary measure.
See every vulnerability recorded for ipython →
FAQ
Versions prior to 8.1.0 are vulnerable to this command injection issue.
The CVSS score for this vulnerability is 4.5, indicating a moderate severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If upgrading is not an option, ensure that any input to the set_term_title function is trusted or filtered to prevent command injection.
While the primary risk is unauthorized command execution, it could potentially lead to data loss or further exploitation depending on the commands executed.
Related vulnerabilities
Recent vulnerabilities recorded for ipython.
