CVE-2019-7653

NameCVE-2019-7653
DescriptionThe Debian python-rdflib-tools 4.2.2-1 package for RDFLib 4.2.2 has CLI tools that can load Python modules from the current working directory, allowing code injection, because "python -m" looks in this directory, as demonstrated by rdf2dot. This issue is specific to use of the debian/scripts directory.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-1717-1
NVD severityhigh (attack range: remote)
Debian Bugs921751

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
rdflib (PTS)jessie4.1.2-3vulnerable
jessie (security)4.1.2-3+deb8u1fixed
stretch4.2.1-2vulnerable
buster, sid4.2.2-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
rdflibsource(unstable)4.2.2-2low921751
rdflibsourcejessie4.1.2-3+deb8u1highDLA-1717-1

Notes

[stretch] - rdflib <no-dsa> (Minor issue)
Debian specific issue as respective scripts are overwritten in Debian
packaging as wrappers invoking python -m.

Search for package or bug name: Reporting problems