CVE-2021-32849: GHSL-2021-076: Arbitrary command execution in Gerapy - CVE-2021-32849
Impact
An authenticated user can execute arbitrary command, see more in https://github.com/Gerapy/Gerapy/issues/211.
Patches
Fixed in 0.9.9
Other sources
An authenticated attacker can execute arbitrary commands on the system.
— GitHub Security Lab
Gerapy is a distributed crawler management framework. Prior to version 0.9.9, an authenticated user could execute arbitrary commands. This issue is fixed in version 0.9.9. There are no known workarounds.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-32849?
CVE-2021-32849 is a vulnerability in the Gerapy distributed crawler management framework that allows an authenticated user to execute arbitrary commands prior to version 0.9.9.
What is the severity of CVE-2021-32849?
CVE-2021-32849 has a severity level of critical with a score of 8.8.
How can I fix CVE-2021-32849?
To fix CVE-2021-32849, upgrade to Gerapy version 0.9.9 or later.
Are there any known workarounds for CVE-2021-32849?
No, there are currently no known workarounds for CVE-2021-32849.
Where can I find more information about CVE-2021-32849?
You can find more information about CVE-2021-32849 on the following references: [Reference 1](https://github.com/Gerapy/Gerapy/issues/197), [Reference 2](https://github.com/Gerapy/Gerapy/issues/217), [Reference 3](https://github.com/Gerapy/Gerapy/security/advisories/GHSA-756h-r2c9-qp5j).