CVE-2018-0524 Code injection in Jubatus
Remote attackers can execute arbitrary code on systems using the Jubatus machine learning library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-0524?
CVE-2018-0524 is a high-severity code injection vulnerability in Jubatus, published on 9 Mar 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Jubatus 1.0.2 and earlier allows remote code execution via unspecified vectors.
Which versions are affected by CVE-2018-0524?
1 open source package ship an affected version, including jubatus. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
jubatus PyPI | All versions | 1.1.0 |
Products include Jubat Jubatus.
How do I fix CVE-2018-0524?
Upgrade jubatus to 1.1.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2018-0524 being exploited?
There is no known exploitation of CVE-2018-0524 in the wild and no public exploit code.
Other vulnerabilities in Jubatus
Sources
Also known as GHSA-hr8g-qqq7-pqgj, PYSEC-2018-114.