CVE-2019-7653

NameCVE-2019-7653
DescriptionThe Debian python-rdflib-tools 4.2.2-1 package for RDFLib 4.2.2 has CLI tools that can load Python modules from the current working directory, allowing code injection, because "python -m" looks in this directory, as demonstrated by rdf2dot. This issue is specific to use of the debian/scripts directory.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
Debian Bugs921751

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
rdflib (PTS)jessie4.1.2-3vulnerable
stretch4.2.1-2vulnerable
buster4.2.2-1vulnerable
sid4.2.2-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
rdflibsource(unstable)4.2.2-2921751

Notes

Debian specific issue as respective scripts are overwritten in Debian
packaging as wrappers invoking python -m.

Search for package or bug name: Reporting problems