Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTZnODgtdnIzdi03Nm1m

Eval injection in Supybot/Limnoria

Eval injection in the Math plugin of Limnoria (before 2019.11.09) and Supybot (through 2018-05-09) allows remote unprivileged attackers to disclose information or possibly have unspecified other impact via the calc and icalc IRC commands.

Permalink: https://github.com/advisories/GHSA-6g88-vr3v-76mf
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTZnODgtdnIzdi03Nm1m
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: over 4 years ago
Updated: 9 months ago

CVSS Score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-6g88-vr3v-76mf, CVE-2019-19010
References:

• https://nvd.nist.gov/vuln/detail/CVE-2019-19010
• https://github.com/ProgVal/Limnoria/commit/3848ae78de45b35c029cc333963d436b9d2f0a35
• https://github.com/ProgVal/Limnoria/wiki/math-eval-vulnerability
• https://lists.fedoraproject.org/archives/list/[email protected]/message/54CQM2TEXRADLE77VOMCPHL5PBHR3ZWJ/
• https://lists.fedoraproject.org/archives/list/[email protected]/message/5P2AGND54UIJV3WHOYO2YINIXSDGAAPO/
• https://lists.fedoraproject.org/archives/list/[email protected]/message/DRNOUHFEN75QAIKT4Y3HDN3TT5LSIWN2/
• https://github.com/advisories/GHSA-6g88-vr3v-76mf

Repository: https://github.com/ProgVal/Limnoria
Blast Radius: 13.2

Affected Packages