CVE-2019-19010
Critical
Description
Eval injection in the Math plugin of Limnoria (before 2019.11.09) and Supybot (through 2018-05-09) allows remote unprivileged attackers to disclose information or possibly have unspecified other impact via the calc and icalc IRC commands.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Limnoria
PublishedNov 16, 2019
First seenNov 16, 2019
How to fix
Update
- limnoria_project limnoria2019.11.09 or later
- limnoria2019.11.09 or later
Vendor advisories
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/54CQM2TEXRADLE77VOMCPHL5PBHR3ZWJ/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DRNOUHFEN75QAIKT4Y3HDN3TT5LSIWN2/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5P2AGND54UIJV3WHOYO2YINIXSDGAAPO/
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| limnoria_project limnoria | v < 2019.11.09 | 2019.11.09 |
| fedoraproject fedora | 29, 30, 31 | — |
| limnoriaPyPI | v < 2019.11.09 | 2019.11.09 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.