CVE-2020-15142 Arbitrary Code Generation
Attackers can achieve arbitrary code execution by crafting malicious OpenAPI documents that generate unsafe Python client code.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-15142?
CVE-2020-15142 is a high-severity code injection vulnerability in triaxtec openapi-python-client, published on 14 Aug 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
In openapi-python-client before version 0.5.3, clients generated with a maliciously crafted OpenAPI Document can generate arbitrary Python code. Subsequent execution of this malicious client is arbitrary code execution.
Weakness: CWE-94
Which versions are affected by CVE-2020-15142?
3 open source packages ship an affected version, including openapi-python-client. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
openapi-python-client PyPI | All versions | 0.5.3 |
openapi-python-client PyPI | All versions | 0.5.3 |
openapi-python-client PyPI | All versions | 0.5.3 |
Products include Openapi-Python-Client Project Openapi-Python-Client.
How do I fix CVE-2020-15142?
Upgrade openapi-python-client to 0.5.3 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2020-15142 being exploited?
There is no known exploitation of CVE-2020-15142 in the wild and no public exploit code.
Other vulnerabilities in triaxtec openapi-python-client
Sources
Also known as GHSA-9x4c-63pf-525f, PYSEC-2020-71.