CVE-2013-4409 ReviewBoard and Djblets library are vulnerable to code execution

Critical 9.8 Published 4 Nov 2019 Updated 6 Aug 2024

Attackers can execute arbitrary code via eval() in JSON parsing within Djblets and Review Board, requiring immediate upgrades.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2013-4409?

CVE-2013-4409 is a critical code injection vulnerability in Fedoraproject Fedora, published on 4 Nov 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An eval() vulnerability exists in Python Software Foundation Djblets 0.7.21 and Beanbag Review Board before 1.7.15 when parsing JSON requests.

Weakness: CWE-20

Which versions are affected by CVE-2013-4409?

8 open source packages ship an affected version, including djblets, ReviewBoard and reviewboard. It affects 4 products.

Package	Affected	Fixed in
`djblets` PyPI	All versions	`0.6.30`
`djblets` PyPI	All versions	`0.6.30`
`djblets` PyPI	All versions	`0.7.21`
`djblets` PyPI	From `0.7.0`	`0.7.19`
`djblets` PyPI	From `0.7.0`	`0.7.19`
`ReviewBoard` PyPI	All versions	`1.7.15`

2 more packages

`reviewboard` PyPI	All versions	`1.7.15`
`reviewboard` PyPI	All versions	`1.7.15`

Products include Fedoraproject Fedora, Redhat Enterprise Linux, Reviewboard Djblets, Reviewboard Review Board.

How do I fix CVE-2013-4409?

Upgrade djblets to a fixed version for your release line: 0.6.30, 0.7.21 or 0.7.19.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2013-4409 being exploited?

There is no known exploitation of CVE-2013-4409 in the wild and no public exploit code.

All Fedoraproject Fedora vulnerabilities

Sources

Also known as GHSA-58h8-44mg-r43x, PYSEC-2019-175, PYSEC-2026-524.