CVE-2023-0575 Remote Code Execution

What is CVE-2023-0575?

CVE-2023-0575 is a high-severity vulnerability in YugabyteDB, published on 9 Feb 2023.

Official description

External Control of Critical State Data, Improper Control of Generation of Code ('Code Injection') vulnerability in YugaByte, Inc. Yugabyte DB on Windows, Linux, MacOS, iOS (DevopsBase.Java:execCommand, TableManager.Java:runCommand modules) allows API Manipulation, Privilege Abuse. This vulnerability is associated with program files backup.Py.

This issue affects Yugabyte DB: Lesser then 2.2.0.0

Weakness: CWE-94, CWE-642

Which versions are affected by CVE-2023-0575?

It affects 1 product.

Products include Yugabyte Yugabytedb.

How do I fix CVE-2023-0575?

No fix has been published for CVE-2023-0575 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-0575 being exploited?

There is no known exploitation of CVE-2023-0575 in the wild and no public exploit code.

Other vulnerabilities in YugabyteDB

• CVE-2022-37397 The software is vulnerable when using LDAP-based authentication in YCQL with Microsoft’s Active Directory High 8.3
• CVE-2024-41435 Memory corruption in n/a High 7.5
• CVE-2023-6002 Log Injection Medium 6.5
• CVE-2023-4640 Set Logging Level Without Authentication Medium 6.5
• CVE-2023-6001 Prometheus Metrics Accessible Pre-Authentication Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-38h3-jcwf-hx88.