pyxdg up to 0.25 Category Element xdg/Menu.py XML Document xml injection

Summaryinfo

A vulnerability identified as critical has been detected in pyxdg up to 0.25. The affected element is an unknown function of the file xdg/Menu.py of the component Category Element Handler. Performing a manipulation as part of XML Document results in xml injection. This vulnerability is identified as CVE-2019-12761. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in pyxdg up to 0.25. It has been classified as critical. This affects some unknown functionality of the file xdg/Menu.py of the component Category Element Handler. The manipulation as part of a XML Document leads to a xml injection vulnerability. CWE is classifying the issue as CWE-91. The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A code injection issue was discovered in PyXDG before 0.26 via crafted Python code in a Category element of a Menu XML document in a .menu file. XDG_CONFIG_DIRS must be set up to trigger xdg.Menu.parse parsing within the directory containing this file. This is due to a lack of sanitization in xdg/Menu.py before an eval call.

The weakness was released 06/06/2019 (Website). It is possible to read the advisory at lists.debian.org. This vulnerability is uniquely identified as CVE-2019-12761 since 06/06/2019. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1505 according to MITRE ATT&CK.

The commercial vulnerability scanner Qualys is able to test this issue with plugin 176990 (Debian Security Update for pyxdg (DLA 1819-1)).

Upgrading to version 0.26 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• pyxdg

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21
• 0.22
• 0.23
• 0.24
• 0.25

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion