What is GHSA-h3qr-fjhm-jphw?

GHSA-h3qr-fjhm-jphw is a security advisory published by GitHub Security Advisories with High severity. Codecov does not sanitize gcov arguments

Which CVE IDs does GHSA-h3qr-fjhm-jphw cover?

GHSA-h3qr-fjhm-jphw covers the following CVE IDs: CVE-2019-10800. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-h3qr-fjhm-jphw?

GHSA-h3qr-fjhm-jphw has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-h3qr-fjhm-jphw?

GHSA-h3qr-fjhm-jphw affects 1 product, including: pip/codecov:\u003c 2.0.16.

GHSA-h3qr-fjhm-jphwHighCVSS 6.5

Codecov does not sanitize gcov arguments

Vendor

GitHub Security Advisories

Published

July 14, 2022

Last Modified

November 18, 2024

🔗 CVE IDs covered (1)

CVE-2019-10800 →

📋 Description

This affects the package codecov before 2.0.16. The vulnerability occurs due to not sanitizing gcov arguments before being being provided to the popen method.

🎯 Affected products1

pip/codecov:< 2.0.16

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2019-10800
https://github.com/codecov/codecov-python/commit/2a80aa434f74feb31242b6f213b75ce63ae97902
https://snyk.io/vuln/SNYK-PYTHON-CODECOV-552149
https://github.com/pypa/advisory-database/tree/main/vulns/codecov/PYSEC-2022-238.yaml
https://github.com/advisories/GHSA-h3qr-fjhm-jphw