Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Related vulnerabilities

PYSEC-2021-72

Vulnerability from pysec - Published: 2021-01-08 12:15 - Updated: 2021-01-12 19:55
VLAI?
Details

This affects the package pwntools before 4.3.1. The shellcraft generator for affected versions of this module are vulnerable to Server-Side Template Injection (SSTI), which can lead to remote code execution.

Impacted products
Name purl
pwntools pkg:pypi/pwntools
Aliases
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "pwntools",
        "purl": "pkg:pypi/pwntools"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.0",
        "2.1.0",
        "2.1.1",
        "2.1.2",
        "2.1.3",
        "2.2",
        "3.0.0",
        "3.0.1",
        "3.0.2",
        "3.0.4",
        "3.1.0b0",
        "3.1.0b1",
        "3.1.0b2",
        "3.1.0b3",
        "3.1.0",
        "3.1.1",
        "3.2.0b0",
        "3.2.0b2",
        "3.2.0b3",
        "3.2.0b4",
        "3.2.0b5",
        "3.2.0",
        "3.2.1",
        "3.3.0b0",
        "3.3.0",
        "3.3.1",
        "3.3.2",
        "3.3.3",
        "3.3.4",
        "3.4.0b0",
        "3.4.0b1",
        "3.4.0b2",
        "3.4.0b3",
        "3.4.0b4",
        "3.4.0",
        "3.4.1",
        "3.5.0b0",
        "3.5.0b1",
        "3.5.0",
        "3.5.1",
        "3.6.0b0",
        "3.6.0b1",
        "3.6.0",
        "3.6.1",
        "3.7.0b0",
        "3.7.0b1",
        "3.7.0",
        "3.7.1",
        "3.8.0b0",
        "3.8.0b1",
        "3.8.0",
        "3.9.0b0",
        "3.9.0",
        "3.9.1",
        "3.9.2",
        "3.9.3",
        "3.10.0b0",
        "3.10.0b1",
        "3.10.0b2",
        "3.10.0",
        "3.11.0b0",
        "3.11.0",
        "3.12.0b0",
        "3.12.0",
        "3.12.1",
        "3.12.2",
        "3.13.0b0",
        "3.13.0",
        "4.0.0b0",
        "4.0.0",
        "4.0.1",
        "4.1.0b0",
        "4.1.0",
        "4.1.1",
        "4.1.2",
        "4.1.3",
        "4.1.4",
        "4.1.5",
        "4.1.6",
        "4.1.7",
        "4.2.0b0",
        "4.2.0",
        "4.2.1",
        "4.2.2",
        "4.3.0b0",
        "4.3.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2020-28468",
    "SNYK-PYTHON-PWNTOOLS-1047345",
    "GHSA-7xc5-ggpp-g249"
  ],
  "details": "This affects the package pwntools before 4.3.1. The shellcraft generator for affected versions of this module are vulnerable to Server-Side Template Injection (SSTI), which can lead to remote code execution.",
  "id": "PYSEC-2021-72",
  "modified": "2021-01-12T19:55:00Z",
  "published": "2021-01-08T12:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://github.com/Gallopsled/pwntools/issues/1427"
    },
    {
      "type": "ADVISORY",
      "url": "https://snyk.io/vuln/SNYK-PYTHON-PWNTOOLS-1047345"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Gallopsled/pwntools/pull/1732"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-7xc5-ggpp-g249"
    }
  ]
}