All Vulnerability Reports

USN-4700-1: PyXDG vulnerability




VMware Tanzu

Versions Affected

  • Canonical Ubuntu 18.04


Alexandre D'Hondt discovered that PyXDG did not properly sanitize input. An attacker could exploit this with a crafted .menu file to execute arbitrary code.

CVEs contained in this USN include: CVE-2019-12761

Affected VMware Products and Versions

Severity is low unless otherwise noted.

  • Platform Automation Toolkit
    • 4.0.x versions prior to 4.0.13
    • 4.1.x versions prior to 4.1.13
    • 4.2.x versions prior to 4.2.8
    • 4.3.x versions prior to 4.3.5


Users of affected products are strongly encouraged to follow the mitigation below. Upgrade VMware Tanzu products that use earlier versions of CF components to new Tanzu releases using new versions linked above. On the Tanzu Network product page for each release, check the Depends On section and/or Release Notes for this information. Releases that have fixed this issue include:

  • Platform Automation Toolkit
    • 4.0.13
    • 4.1.13
    • 4.2.8
    • 4.3.5



2021-03-01: Initial vulnerability report published.