RCE in Astropy
CVE-2023-41334
Astropy is a project for astronomy in Python that fosters interoperability between Python astronomy packages. Version 5.3.2 of the Astropy core package is vulnerable to remote code execution due to improper input validation in the `TranformGraph().to_dot_graph` function. A malicious user can provide a command or a script file as a value to the `savelayout` argument, which will be placed as the first value in a list of arguments passed to `subprocess.Popen`. Although an error will be raised, the command or script will be executed successfully. Version 5.3.3 fixes this issue.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.011 (62.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.4 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Astropy — versions = 5.3.2, 5.3.2
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (Product, x_refsource_MISC)
Frequently asked questions
- What is CVE-2023-41334?
- CVE-2023-41334 is a high-severity vulnerability in Astropy, classified under Command Injection. CVSS score: 8.4/10. Published 2024-03-18.
- How severe is CVE-2023-41334?
- High severity. CVSS v3 base score is 8.4 out of 10.
- Is CVE-2023-41334 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.