CVE-2020-15142

Advisory

In openapi-python-client before version 0.5.3, clients generated with a maliciously crafted OpenAPI Document can generate arbitrary Python code. Subsequent execution of this malicious client is arbitrary code execution. See: CVE-2020-15142.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

In openapi-python-client before version 0.5.3, clients generated with a maliciously crafted OpenAPI Document can generate arbitrary Python code. Subsequent execution of this malicious client is arbitrary code execution.


CONFIRM:https://github.com/triaxtec/openapi-python-client/security/advisories/GHSA-9x4c-63pf-525f: https://github.com/triaxtec/openapi-python-client/security/advisories/GHSA-9x4c-63pf-525f
MISC:https://github.com/triaxtec/openapi-python-client/blob/main/CHANGELOG.md#053---2020-08-13: https://github.com/triaxtec/openapi-python-client/blob/main/CHANGELOG.md#053---2020-08-13
MISC:https://github.com/triaxtec/openapi-python-client/commit/f7a56aae32cba823a77a84a1f10400799b19c19a: https://github.com/triaxtec/openapi-python-client/commit/f7a56aae32cba823a77a84a1f10400799b19c19a
MISC:https://pypi.org/project/openapi-python-client/: https://pypi.org/project/openapi-python-client/

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15142
• https://github.com/triaxtec/openapi-python-client/blob/main/CHANGELOG.md#053---2020-08-13
• https://pypi.org/project/openapi-python-client/
• https://github.com/triaxtec/openapi-python-client/commit/f7a56aae32cba823a77a84a1f10400799b19c19a
• https://github.com/triaxtec/openapi-python-client/security/advisories/GHSA-9x4c-63pf-525f