CVE-2017-1002157 modulemd uses an unsafe function for processing externally provided data
An unsafe function in the modulemd library allows remote code execution when processing externally provided data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-1002157?
CVE-2017-1002157 is a critical code injection vulnerability in Fedora Modularity modulemd, published on 10 Jan 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
modulemd 1.3.1 and earlier uses an unsafe function for processing externally provided data, leading to remote code execution.
Which versions are affected by CVE-2017-1002157?
3 open source packages ship an affected version, including modulemd. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
modulemd PyPI | All versions | 1.3.2 |
modulemd PyPI | All versions | 1.3.2 |
modulemd PyPI | All versions | 1.3.2 |
Products include Redhat Modulemd.
How do I fix CVE-2017-1002157?
Upgrade modulemd to 1.3.2 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2017-1002157 being exploited?
There is no known exploitation of CVE-2017-1002157 in the wild and no public exploit code.
Sources
Also known as GHSA-jhjh-ghwx-6h7r, PYSEC-2019-153.