Headline
GHSA-38jr-29fh-w9vm: ansys-geometry-core OS Command Injection vulnerability
subprocess call with shell=True identified, security issue.
Code
On file src/ansys/geometry/core/connection/product_instance.py:
403 def _start_program(args: List[str], local_env: Dict[str, str]) -> subprocess.Popen:
404 """
405 Start the program where the path is the first item of the ``args`` array argument.
406
407 Parameters
408 ----------
409 args : List[str]
410 List of arguments to be passed to the program. The first list's item shall
411 be the program path.
412 local_env : Dict[str,str]
413 Environment variables to be passed to the program.
414
415 Returns
416 -------
417 subprocess.Popen
418 The subprocess object.
419 """
420 return subprocess.Popen(
421 args,
422 shell=os.name != "nt",
423 stdin=subprocess.DEVNULL,
424 stdout=subprocess.DEVNULL,
425 stderr=subprocess.DEVNULL,
426 env=local_env,
427 )
428
429
Upon calling this method _start_program directly, users could exploit its usage to perform malicious operations on the current machine where the script is ran. With this resolution made through #1076 and #1077, we make sure that this method is only called from within the library and we are no longer enabling the shell=True option.
CWE - 78
For more information see https://cwe.mitre.org/data/definitions/78.html
More information
Visit https://bandit.readthedocs.io/en/1.7.8/plugins/b602_subprocess_popen_with_shell_equals_true.html to find out more information.
- GitHub Advisory Database
- GitHub Reviewed
- CVE-2024-29189
ansys-geometry-core OS Command Injection vulnerability
High severity GitHub Reviewed Published Mar 25, 2024 in ansys/pyansys-geometry • Updated Mar 25, 2024
Package
pip ansys-geometry-core (pip)
Affected versions
>= 0.3.0, < 0.3.3
>= 0.4.0, < 0.4.12
Patched versions
0.3.3
0.4.12
subprocess call with shell=True identified, security issue.
Code
On file src/ansys/geometry/core/connection/product_instance.py:
403 def _start_program(args: List[str], local_env: Dict[str, str]) -> subprocess.Popen:
404 """
405 Start the program where the path is the first item of the ``args`` array argument.
406
407 Parameters
408 ----------
409 args : List[str]
410 List of arguments to be passed to the program. The first list's item shall
411 be the program path.
412 local_env : Dict[str,str]
413 Environment variables to be passed to the program.
414
415 Returns
416 -------
417 subprocess.Popen
418 The subprocess object.
419 """
420 return subprocess.Popen(
421 args,
422 shell=os.name != "nt",
423 stdin=subprocess.DEVNULL,
424 stdout=subprocess.DEVNULL,
425 stderr=subprocess.DEVNULL,
426 env=local_env,
427 )
428
429
Upon calling this method _start_program directly, users could exploit its usage to perform malicious operations on the current machine where the script is ran. With this resolution made through #1076 and #1077, we make sure that this method is only called from within the library and we are no longer enabling the shell=True option.
CWE - 78
For more information see https://cwe.mitre.org/data/definitions/78.html
More information
Visit https://bandit.readthedocs.io/en/1.7.8/plugins/b602_subprocess_popen_with_shell_equals_true.html to find out more information.
References
- GHSA-38jr-29fh-w9vm
- ansys/pyansys-geometry#1076
- ansys/pyansys-geometry#1077
- ansys/pyansys-geometry@9020717
- ansys/pyansys-geometry@f82346b
- https://bandit.readthedocs.io/en/1.7.8/plugins/b602_subprocess_popen_with_shell_equals_true.html
- https://github.com/ansys/pyansys-geometry/blob/52cba1737a8a7812e5430099f715fa2160ec007b/src/ansys/geometry/core/connection/product_instance.py#L403-L428
Published to the GitHub Advisory Database
Mar 25, 2024
Last updated
Mar 25, 2024