CVE-2019-7653
The Debian python-rdflib-tools 4.2.2-1 package for RDFLib 4.2.2 has CLI tools that can load Python modules from the current working directory, allowing code injection, because "python -m" looks in this directory, as demonstrated by rdf2dot. This issue is specific to use of the debian/scripts directory.
- Score
- CVSS 3.1 9.8 Critical
- Status
- Modified - cve@mitre.org
- Published
- 2019-02-09
- Last modified
- 2024-08-04
- Weaknesses
- CWE-427
Affected products
References
- https://bugs.debian.org/921751
- https://lists.debian.org/debian-lts-announce/2019/03/msg00019.html
- https://lists.debian.org/debian-lts-announce/2021/12/msg00026.html
- https://usn.ubuntu.com/4535-1/
