CVE-2020-13388: OS Command Injection
An exploitable vulnerability exists in the configuration-loading functionality of the jw.util package before 2.3 for Python. When loading a configuration with FromString or FromStream with YAML, one can execute arbitrary Python code, resulting in OS command execution, because safeload is not used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-13388?
CVE-2020-13388 is classified as a high-severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2020-13388?
To fix CVE-2020-13388, upgrade the jw.util package to version 2.3 or later, which implements safe YAML loading.
What type of attack can be performed due to CVE-2020-13388?
CVE-2020-13388 allows attackers to execute arbitrary Python code through insecure loading of YAML configurations.
Who is affected by CVE-2020-13388?
CVE-2020-13388 affects users of jw.util package versions prior to 2.3 in Python applications.
What are the consequences of exploiting CVE-2020-13388?
Exploiting CVE-2020-13388 can lead to OS command execution, allowing attackers to gain control over the affected system.