Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:pypi/duckdb@0.3.3
Typepypi
Namespace
Nameduckdb
Version0.3.3
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version0.9.3.dev6
Latest_non_vulnerable_version1.4.2
Affected_by_vulnerabilities
0
url VCID-bzft-w6ms-m3g9
vulnerability_id VCID-bzft-w6ms-m3g9
summary DuckDB is a SQL database management system. In versions 1.0.0 and prior, content in filesystem is accessible for reading using `sniff_csv`, even with `enable_external_access=false`. This vulnerability provides an attacker with access to filesystem even when access is expected to be disabled and other similar functions do NOT provide access. There seem to be two vectors to this vulnerability. First, access to files that should otherwise not be allowed. Second, the content from a file can be read (e.g. `/etc/hosts`, `proc/self/environ`, etc) even though that doesn't seem to be the intent of the sniff_csv function. A fix for this issue is available in commit c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8a and is expected to be part of version 1.1.0.
references
0
reference_url https://github.com/duckdb/duckdb
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/duckdb/duckdb
1
reference_url https://github.com/duckdb/duckdb/commit/c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8a
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/duckdb/duckdb/commit/c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8a
2
reference_url https://github.com/duckdb/duckdb/pull/13133
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/duckdb/duckdb/pull/13133
3
reference_url https://github.com/duckdb/duckdb/security/advisories/GHSA-w2gf-jxc9-pf2q
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/duckdb/duckdb/security/advisories/GHSA-w2gf-jxc9-pf2q
4
reference_url https://github.com/pypa/advisory-database/tree/main/vulns/duckdb/PYSEC-2024-203.yaml
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/pypa/advisory-database/tree/main/vulns/duckdb/PYSEC-2024-203.yaml
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-41672
reference_id CVE-2024-41672
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-41672
6
reference_url https://github.com/advisories/GHSA-w2gf-jxc9-pf2q
reference_id GHSA-w2gf-jxc9-pf2q
reference_type
scores
url https://github.com/advisories/GHSA-w2gf-jxc9-pf2q
fixed_packages
0
url pkg:pypi/duckdb@1.1.0
purl pkg:pypi/duckdb@1.1.0
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/duckdb@1.1.0
aliases CVE-2024-41672, GHSA-w2gf-jxc9-pf2q, PYSEC-2024-203
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-bzft-w6ms-m3g9
1
url VCID-dkjy-h9bw-7kgv
vulnerability_id VCID-dkjy-h9bw-7kgv
summary DuckDB <=0.9.2 and DuckDB extension-template <=0.9.2 are vulnerable to malicious extension injection via the custom extension feature.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-22682.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-22682.json
1
reference_url https://github.com/Tu0Laj1/database_test
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
url https://github.com/Tu0Laj1/database_test
2
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2261875
reference_id 2261875
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2261875
fixed_packages
0
url pkg:pypi/duckdb@0.9.3.dev6
purl pkg:pypi/duckdb@0.9.3.dev6
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/duckdb@0.9.3.dev6
aliases CVE-2024-22682, PYSEC-2024-25
risk_score 4.4
exploitability 0.5
weighted_severity 8.8
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-dkjy-h9bw-7kgv
Fixing_vulnerabilities
Risk_score4.4
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:pypi/duckdb@0.3.3