CVE-2019-19010: Code Injection
Eval injection in the Math plugin of Limnoria (before 2019.11.09) and Supybot (through 2018-05-09) allows remote unprivileged attackers to disclose information or possibly have unspecified other impact via the calc and icalc IRC commands.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/limnoriato a version that resolves this vulnerability.Fixed in 2019.11.09
Event History
Frequently Asked Questions
What is the severity of CVE-2019-19010?
CVE-2019-19010 is categorized as a medium severity vulnerability due to its potential for information disclosure.
How do I fix CVE-2019-19010?
To fix CVE-2019-19010, upgrade Limnoria to version 2019.11.09 or later.
What software is affected by CVE-2019-19010?
CVE-2019-19010 affects Limnoria prior to version 2019.11.09 and Supybot through 2018-05-09.
Is there a risk of data breach with CVE-2019-19010?
Yes, CVE-2019-19010 allows remote unprivileged attackers to potentially disclose sensitive information.
What commands are involved in CVE-2019-19010?
The vulnerable commands in CVE-2019-19010 are the calc and icalc IRC commands.