CVE-2023-41334

Name	CVE-2023-41334
Description	Astropy is a project for astronomy in Python that fosters interoperability between Python astronomy packages. Version 5.3.2 of the Astropy core package is vulnerable to remote code execution due to improper input validation in the `TranformGraph().to_dot_graph` function. A malicious user can provide a command or a script file as a value to the `savelayout` argument, which will be placed as the first value in a list of arguments passed to `subprocess.Popen`. Although an error will be raised, the command or script will be executed successfully. Version 5.3.3 fixes this issue.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3803-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
astropy (PTS)	bullseye	4.2-6	vulnerable
	bookworm	5.2.1-2	vulnerable
	sid, trixie	7.0.0-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
astropy	source	buster	3.1.2-2+deb10u1		DLA-3803-1
astropy	source	(unstable)	5.3.3-1

Notes

[bookworm] - astropy <no-dsa> (Minor issue)
[bullseye] - astropy <no-dsa> (Minor issue)
https://github.com/astropy/astropy/security/advisories/GHSA-h2x6-5jx5-46hf
https://github.com/astropy/astropy/commit/22057d37b1313f5f5a9b5783df0a091d978dccb5 (v5.3.3)