GHSA-xxhh-59gh-6ffx

SAP Cloud SDK for AI Python has OS Command Injection when Program Objects Execution is Enabled

Source: GitHub Advisory Database (reviewed) High CVE-2023-25617

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	sap-ai-sdk-base	<= 3.3.0	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

SAP Business Object (Adaptive Job Server) - versions 420, 430, allows remote execution of arbitrary commands on Unix, when program objects execution is enabled, to authenticated users with scheduling rights, using the BI Launchpad, Central Management Console or a custom application based on the public java SDK. Programs could impact the confidentiality, integrity and availability of the system.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-25617 advisory
https://github.com/pypa/advisory-database/tree/main/vulns/sap-ai-sdk-base/PYSEC-2023-315.yaml web
https://launchpad.support.sap.com/#/notes/3283438 web
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html web
https://www.sap.com/index.html package