USN-4700-1: PyXDG vulnerability
Severity
Low
Vendor
VMware Tanzu
Versions Affected
- Canonical Ubuntu 18.04
Description
Alexandre D'Hondt discovered that PyXDG did not properly sanitize input. An attacker could exploit this with a crafted .menu file to execute arbitrary code.
CVEs contained in this USN include: CVE-2019-12761
Affected VMware Products and Versions
Severity is low unless otherwise noted.
-
Platform Automation Toolkit
- 4.0.x versions prior to 4.0.13
- 4.1.x versions prior to 4.1.13
- 4.2.x versions prior to 4.2.8
- 4.3.x versions prior to 4.3.5
Mitigation
Users of affected products are strongly encouraged to follow the mitigation below. Upgrade VMware Tanzu products that use earlier versions of CF components to new Tanzu releases using new versions linked above. On the Tanzu Network product page for each release, check the Depends On section and/or Release Notes for this information. Releases that have fixed this issue include:
-
Platform Automation Toolkit
- 4.0.13
- 4.1.13
- 4.2.8
- 4.3.5
References
- https://people.canonical.com/~ubuntu-security/cve/CVE-2019-12761
- https://ubuntu.com/security/notices/USN-4700-1
History
2021-03-01: Initial vulnerability report published.