CVE-2023-41334 astropy vulnerable to RCE in TranformGraph().to_dot_graph function
A command injection vulnerability in the astropy library allows attackers to execute arbitrary code via the to_dot_graph function.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-41334?
CVE-2023-41334 is a high-severity command injection vulnerability in astropy, published on 18 Mar 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Astropy is a project for astronomy in Python that fosters interoperability between Python astronomy packages. Version 5.3.2 of the Astropy core package is vulnerable to remote code execution due to improper input validation in the `TranformGraph().to_dot_graph` function. A malicious user can provide a command or a script file as a value to the `savelayout` argument, which will be placed as the first value in a list of arguments passed to `subprocess.Popen`. Although an error will be raised, the command or script will be executed successfully. Version 5.3.3 fixes this issue.
Weakness: CWE-77
Which versions are affected by CVE-2023-41334?
3 open source packages ship an affected version, including astropy. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
astropy PyPI | All versions | 5.3.3 |
astropy PyPI | All versions | 5.3.3 |
astropy PyPI | All versions | 5.3.3 |
Linux distribution packages (1)
python-astropy openSUSE:Tumbleweed | All versions | 8.0.1-1.1 |
Products include Astropy Astropy.
How do I fix CVE-2023-41334?
Upgrade astropy to 5.3.3 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2023-41334 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-41334 exists.
Sources
Also known as DEBIAN-CVE-2023-41334, DLA-3803-1, GHSA-h2x6-5jx5-46hf, MGASA-2024-0313, PYSEC-2026-1199, UBUNTU-CVE-2023-41334 and 2 more.