Vulnerability Description
The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the update_repo function (when using hg), the url parameter is passed to the hg clone command. By injecting some hg options it was possible to get arbitrary command execution.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Libvcs Project | Libvcs | < 0.11.1 |
Related Weaknesses (CWE)
References
- https://github.com/vcs-python/libvcs/blob/v0.11.1/CHANGES%23libvcs-0111-2022-03-Release NotesThird Party Advisory
- https://github.com/vcs-python/libvcs/pull/306PatchThird Party Advisory
- https://snyk.io/vuln/SNYK-PYTHON-LIBVCS-2421204Third Party Advisory
- https://github.com/vcs-python/libvcs/blob/v0.11.1/CHANGES%23libvcs-0111-2022-03-Release NotesThird Party Advisory
- https://github.com/vcs-python/libvcs/pull/306PatchThird Party Advisory
- https://snyk.io/vuln/SNYK-PYTHON-LIBVCS-2421204Third Party Advisory
FAQ
What is CVE-2022-21187?
CVE-2022-21187 is a vulnerability with a CVSS score of 8.1 (HIGH). The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the update_repo function (when using hg), the url parameter is passed to the hg clone command....
How severe is CVE-2022-21187?
CVE-2022-21187 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-21187?
Check the references section above for vendor advisories and patch information. Affected products include: Libvcs Project Libvcs.