Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS03NDg4LTZ4M3ItMjN3Nc4AAtX6
Ganga allows absolute path traversal
The ganga-devs/ganga repository before 8.5.10 on GitHub allows absolute path traversal because the Flask send_file
function is used unsafely.
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03NDg4LTZ4M3ItMjN3Nc4AAtX6
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: almost 2 years ago
Updated: 8 months ago
CVSS Score: 9.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Identifiers: GHSA-7488-6x3r-23w5, CVE-2022-31507
References:
- https://nvd.nist.gov/vuln/detail/CVE-2022-31507
- https://github.com/github/securitylab/issues/669#issuecomment-1117265726
- https://github.com/ganga-devs/ganga/commit/730e7aba192407d35eb37dd7938d49071124be8c
- https://github.com/ganga-devs/ganga/releases/tag/8.5.10
- https://github.com/pypa/advisory-database/tree/main/vulns/ganga/PYSEC-2022-225.yaml
- https://github.com/advisories/GHSA-7488-6x3r-23w5
Blast Radius: 5.6
Affected Packages
pypi:ganga
Dependent packages: 0Dependent repositories: 4
Downloads: 572 last month
Affected Version Ranges: < 8.5.10
Fixed in: 8.5.10
All affected versions: 6.1.15, 6.1.16, 6.1.17, 6.1.18, 6.1.19, 6.1.20, 6.1.21, 6.1.22, 6.1.23, 6.1.24, 6.1.25, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.5.1, 6.5.2, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.7.0, 6.7.1, 6.7.2, 6.7.3, 6.7.4, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.1.0, 7.1.1, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.1.11, 7.1.12, 7.1.13, 7.1.14, 7.1.15, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.1.0, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.3.0, 8.3.1, 8.3.2, 8.3.3, 8.3.4, 8.3.5, 8.4.0, 8.4.1, 8.4.2, 8.4.4, 8.4.5, 8.4.6, 8.4.7, 8.4.8, 8.5.0, 8.5.1, 8.5.2, 8.5.3, 8.5.4, 8.5.5, 8.5.6, 8.5.7, 8.5.8, 8.5.9
All unaffected versions: 8.5.10, 8.6.0, 8.6.1, 8.6.2, 8.6.3, 8.6.4, 8.6.5, 8.6.6, 8.6.7, 8.6.8, 8.6.9, 8.6.10, 8.7.0, 8.7.1, 8.7.2, 8.7.3, 8.7.4, 8.7.5, 8.7.6