GHSA-7xc5-ggpp-g249

pwntools Server-Side Template Injection (SSTI) vulnerability

Source: GitHub Advisory Database (reviewed) Critical CVE-2020-28468

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	pwntools	< 4.3.1	4.3.1

Details

As written in the advisory (Markdown source, shown as plain text).

This affects the package pwntools before 4.3.1. The shellcraft generator for affected versions of this module are vulnerable to Server-Side Template Injection (SSTI), which can lead to remote code execution.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-28468 advisory
https://github.com/Gallopsled/pwntools/issues/1427 web
https://github.com/Gallopsled/pwntools/pull/1732 web
https://github.com/Gallopsled/pwntools/commit/138188eb1c027a2d0ffa4151511c407d3a001660 web
https://github.com/Gallopsled/pwntools package
https://github.com/advisories/GHSA-7xc5-ggpp-g249 advisory
https://github.com/pypa/advisory-database/tree/main/vulns/pwntools/PYSEC-2021-72.yaml web
https://snyk.io/vuln/SNYK-PYTHON-PWNTOOLS-1047345 web