Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:pypi/duckdb@0.1.9
Typepypi
Namespace
Nameduckdb
Version0.1.9
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version0.9.3.dev6
Latest_non_vulnerable_version1.4.2
Affected_by_vulnerabilities
0
url VCID-bzft-w6ms-m3g9
vulnerability_id VCID-bzft-w6ms-m3g9
summary DuckDB is a SQL database management system. In versions 1.0.0 and prior, content in filesystem is accessible for reading using `sniff_csv`, even with `enable_external_access=false`. This vulnerability provides an attacker with access to filesystem even when access is expected to be disabled and other similar functions do NOT provide access. There seem to be two vectors to this vulnerability. First, access to files that should otherwise not be allowed. Second, the content from a file can be read (e.g. `/etc/hosts`, `proc/self/environ`, etc) even though that doesn't seem to be the intent of the sniff_csv function. A fix for this issue is available in commit c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8a and is expected to be part of version 1.1.0.
references
0
reference_url https://github.com/duckdb/duckdb/commit/c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8a
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
url https://github.com/duckdb/duckdb/commit/c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8a
1
reference_url https://github.com/duckdb/duckdb/pull/13133
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
url https://github.com/duckdb/duckdb/pull/13133
2
reference_url https://github.com/duckdb/duckdb/security/advisories/GHSA-w2gf-jxc9-pf2q
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
url https://github.com/duckdb/duckdb/security/advisories/GHSA-w2gf-jxc9-pf2q
fixed_packages
0
url pkg:pypi/duckdb@1.1.0
purl pkg:pypi/duckdb@1.1.0
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/duckdb@1.1.0
aliases CVE-2024-41672, PYSEC-2024-203
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-bzft-w6ms-m3g9
1
url VCID-dkjy-h9bw-7kgv
vulnerability_id VCID-dkjy-h9bw-7kgv
summary DuckDB <=0.9.2 and DuckDB extension-template <=0.9.2 are vulnerable to malicious extension injection via the custom extension feature.
references
0
reference_url https://github.com/Tu0Laj1/database_test
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
url https://github.com/Tu0Laj1/database_test
fixed_packages
0
url pkg:pypi/duckdb@0.9.3.dev6
purl pkg:pypi/duckdb@0.9.3.dev6
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/duckdb@0.9.3.dev6
aliases CVE-2024-22682, PYSEC-2024-25
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-dkjy-h9bw-7kgv
Fixing_vulnerabilities
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:pypi/duckdb@0.1.9