Workflow

PyPi: Ansys-Geometry-Core

CVE-2024-29189

Safety vulnerability ID: 66973

This vulnerability was reviewed by experts

The information on this page was manually curated by our Cybersecurity Intelligence Team.

Created at Mar 26, 2024 Updated at Nov 29, 2024
Scan your Python projects for vulnerabilities →

Advisory

PyAnsys Geometry is a Python client library for the Ansys Geometry service and other CAD Ansys products. On file src/ansys/geometry/core/connection/product_instance.py, upon calling this method _start_program directly, users could exploit its usage to perform malicious operations on the current machine where the script is ran. This vulnerability is fixed in 0.3.3 and 0.4.12. See CVE-2024-29189.

Affected package

ansys-geometry-core

Latest version: 0.7.6

A python wrapper for Ansys Geometry service

Affected versions

Fixed versions

Vulnerability changelog

PyAnsys Geometry is a Python client library for the Ansys Geometry service and other CAD Ansys products. On file src/ansys/geometry/core/connection/product_instance.py, upon calling this method _start_program directly, users could exploit its usage to perform malicious operations on the current machine where the script is ran. This vulnerability is fixed in 0.3.3 and 0.4.12. See CVE-2024-29189.


MISC:https://bandit.readthedocs.io/en/1.7.8/plugins/b602_subprocess_popen_with_shell_equals_true.html: https://bandit.readthedocs.io/en/1.7.8/plugins/b602_subprocess_popen_with_shell_equals_true.html
MISC:https://github.com/ansys/pyansys-geometry/blob/52cba1737a8a7812e5430099f715fa2160ec007b/src/ansys/geometry/core/connection/product_instance.py#L403-L428: https://github.com/ansys/pyansys-geometry/blob/52cba1737a8a7812e5430099f715fa2160ec007b/src/ansys/geometry/core/connection/product_instance.py#L403-L428
MISC:https://github.com/ansys/pyansys-geometry/commit/902071701c4f3a8258cbaa46c28dc0a65442d1bc: https://github.com/ansys/pyansys-geometry/commit/902071701c4f3a8258cbaa46c28dc0a65442d1bc
MISC:https://github.com/ansys/pyansys-geometry/commit/f82346b9432b06532e84f3278125f5879b4e9f3f: https://github.com/ansys/pyansys-geometry/commit/f82346b9432b06532e84f3278125f5879b4e9f3f
MISC:https://github.com/ansys/pyansys-geometry/pull/1076: https://github.com/ansys/pyansys-geometry/pull/1076
MISC:https://github.com/ansys/pyansys-geometry/pull/1077: https://github.com/ansys/pyansys-geometry/pull/1077
MISC:https://github.com/ansys/pyansys-geometry/security/advisories/GHSA-38jr-29fh-w9vm: https://github.com/ansys/pyansys-geometry/security/advisories/GHSA-38jr-29fh-w9vm

Resources

Use this package?

Scan your Python project for dependency vulnerabilities in two minutes

Scan your application