CVE-2019-7653: Code Injection
Last updated 24 July 2024
Other sources
The Debian python-rdflib-tools 4.2.2-1 package for RDFLib 4.2.2 has CLI tools that can load Python modules from the current working directory, allowing code injection, because "python -m" looks in this directory, as demonstrated by rdf2dot. This issue is specific to use of the debian/scripts directory.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-7653?
CVE-2019-7653 is categorized as a moderate severity vulnerability due to its potential for code injection.
How do I fix CVE-2019-7653?
To mitigate CVE-2019-7653, upgrade rdfLib to versions 5.0.0-1.1, 6.1.1-1, or 7.1.1-2 in your Debian or Ubuntu system.
Which versions of rdfLib are affected by CVE-2019-7653?
CVE-2019-7653 affects rdfLib version 4.2.2.
Is CVE-2019-7653 specific to any operating systems?
Yes, CVE-2019-7653 affects Debian GNU/Linux versions 8.0 and 9.0, as well as Ubuntu Linux 16.04.
What types of attacks can CVE-2019-7653 facilitate?
CVE-2019-7653 can facilitate code injection attacks by allowing loading of unauthorized Python modules.