What is GHSA-jhjh-ghwx-6h7r?

GHSA-jhjh-ghwx-6h7r is a security advisory published by GitHub Security Advisories with Critical severity. modulemd uses an unsafe function for processing externally provided data

Which CVE IDs does GHSA-jhjh-ghwx-6h7r cover?

GHSA-jhjh-ghwx-6h7r covers the following CVE IDs: CVE-2017-1002157. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-jhjh-ghwx-6h7r?

GHSA-jhjh-ghwx-6h7r has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-jhjh-ghwx-6h7r?

GHSA-jhjh-ghwx-6h7r affects 1 product, including: pip/modulemd:\u003c 1.3.2.

GHSA-jhjh-ghwx-6h7rCriticalCVSS 9.8

modulemd uses an unsafe function for processing externally provided data

Vendor

GitHub Security Advisories

Published

January 17, 2019

Last Modified

September 24, 2024

🔗 CVE IDs covered (1)

CVE-2017-1002157 →

📋 Description

modulemd 1.3.1 and earlier uses an unsafe function for processing externally provided data, leading to remote code execution.

🎯 Affected products1

pip/modulemd:< 1.3.2

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2017-1002157
https://pagure.io/modulemd/issue/55
https://github.com/pypa/advisory-database/tree/main/vulns/modulemd/PYSEC-2019-153.yaml
https://github.com/advisories/GHSA-jhjh-ghwx-6h7r