CVE-2020-13388 OS Command Injection in jw.util
Attackers can execute arbitrary Python code via unsafe YAML parsing in the jw.util package, leading to OS command execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-13388?
CVE-2020-13388 is a critical code injection vulnerability in n/a, published on 22 May 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An exploitable vulnerability exists in the configuration-loading functionality of the jw.util package before 2.3 for Python. When loading a configuration with FromString or FromStream with YAML, one can execute arbitrary Python code, resulting in OS command execution, because safe_load is not used.
Weakness: CWE-78
Which versions are affected by CVE-2020-13388?
3 open source packages ship an affected version, including jw-util and jw.util. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
jw-util PyPI | All versions | 2.3 |
jw-util PyPI | All versions | 2.3 |
jw.util PyPI | All versions | 2.3 |
Products include Python Jw.util.
How do I fix CVE-2020-13388?
Upgrade jw-util to 2.3 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2020-13388 being exploited?
There is no known exploitation of CVE-2020-13388 in the wild and no public exploit code.
Sources
Also known as GHSA-h72c-w3q3-55qq, PYSEC-2020-341.