XML injection in pyxdg - CVE-2019-12761

Vulnerability identifier: #VU51178

CSH Severity: Medium

CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-12761

CWE-ID: CWE-91

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation when processing XML data in xdg/Menu.py before an eval call. A remote unauthenticated attacker can pass specially crafted XML data to the application and perform arbitrary actions on the system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

pyxdg
Platform Automation Toolkit
SUSE CaaS Platform
SUSE Enterprise Storage
Fedora
Ubuntu
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
python-xdg (Ubuntu package)
python3-xdg (Ubuntu package)
pyxdg
python2-pyxdg
python3-pyxdg

Install updates from vendor's website.

pyxdg - update to 0.26
python-xdg (Ubuntu package) - addressed in versions 0.25-4ubuntu0.16.04.1, 0.25-4ubuntu1.1
python3-xdg (Ubuntu package) - addressed in versions 0.25-4ubuntu0.16.04.1, 0.25-4ubuntu1.1
pyxdg - update to 0.25-8.el7
python2-pyxdg - update to 0.25-150000.3.3.1
python3-pyxdg - update to 0.25-150000.3.3.1
Platform Automation Toolkit - addressed in versions 4.0.13, 4.1.13, 4.2.8, 4.3.5

• https://gist.github.com/dhondta/b45cd41f4186110a354dc7272916feba
• https://lists.debian.org/debian-lts-announce/2019/06/msg00006.html
• https://snyk.io/vuln/SNYK-PYTHON-PYXDG-174562

• XML injection in PyXDG
• XML injection in VMware Tanzu Platform Automation Toolkit
• Ubuntu update for pyxdg
• SUSE update for python-pyxdg
• Fedora EPEL 7 update for pyxdg