CVE-2020-7698

Description

This affects the package Gerapy from 0 and before 0.9.3. The input being passed to Popen, via the project_configure endpoint, isn’t being sanitized.

How to fix CVE-2020-7698

To remediate CVE-2020-7698, upgrade the affected package to a fixed version below.

• PyPI/gerapy—upgrade to 0.9.3 or later
• PyPI/gerapy—upgrade to e8446605eb2424717418eae199ec7aad573da2d2 or later

Is CVE-2020-7698 being exploited?

Low — EPSS is 0.5%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, < 0.9.3
• from 0, < e8446605eb2424717418eae199ec7aad573da2d2 | from 0, < 0.9.3

CVSS scores

References (6)

• ADVISORYgithub.com/advisories/GHSA-g57j-q48p-9vm2
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2020-7698
• PATCHgithub.com/Gerapy/Gerapy
• WEBgithub.com/Gerapy/Gerapy/commit/e8446605eb2424717418eae199ec7aad573da2d2