CVE-2019-19010: Limnoria Eval Injection Vulnerability

CRITICAL
Advisory Identifier: GHSA-6g88-vr3v-76mf
Share
CVSS 9.8
CWE-94
Published
Advisory Summary

CVE-2019-19010 is a CRITICAL (CVSS 9.8) eval injection vulnerability (CWE-94: Improper Control of Generation of Code ('Code Injection')) affecting Limnoria libraries in the PyPI ecosystem. The issue involves eval injection in supybot/limnoria. Remediation is available by upgrading affected packages to version 2019.11.09.

CVE-2019-19010 at a Glance

CVE Identifier CVE-2019-19010
GHSA Identifier GHSA-6g88-vr3v-76mf
Severity CRITICAL
CVSS v3.1 Base Score 9.8
CWE Classification CWE-94: Improper Control of Generation of Code ('Code Injection')
Affected Product Limnoria
Package Ecosystem PyPI
Published Date
Last Updated

Security Impact

CVSS: 9.8

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity High (I:H)
Availability High (A:H)

How to Fix CVE-2019-19010

To remediate this vulnerability, upgrade all affected Limnoria dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

limnoria fixed: 2019.11.09 
pip install limnoria>=2019.11.09
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

pip show limnoria

How to Check if You Are Affected

To determine whether your Python environment is affected by CVE-2019-19010, inspect your installed packages using pip:

pip show limnoria

Analyze the terminal output to locate any version of Limnoria in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2019.11.09), your application is affected.

Note: The pip show limnoria command checks currently installed packages in your active Python environment.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-94: Improper Control of Generation of Code ('Code Injection'), where the product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. In Limnoria, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

Eval injection in the Math plugin of Limnoria (before 2019.11.09) and Supybot (through 2018-05-09) allows remote unprivileged attackers to disclose information or possibly have unspecified other impact via the calc and icalc IRC commands.

CVE-2019-19010 Affected Limnoria Versions

1 component(s)
Fixed Versions:
2019.11.09
Product / Package Ecosystem Affected Versions Fixed Version
limnoria
pypi/limnoria
PyPI
< 2019.11.09
2019.11.09

References

NVD — CVE-2019-19010 NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-19010
Security Fix Commit FIX COMMIT
https://github.com/ProgVal/Limnoria/commit/3848ae78de45b35c029cc333963d436b9d2f0a35
Limnoria Source Repository REPOSITORY
https://github.com/ProgVal/Limnoria
GitHub Advisory / Wiki ADVISORY
https://github.com/ProgVal/Limnoria/wiki/math-eval-vulnerability
GitHub Advisory / Wiki ADVISORY
https://github.com/advisories/GHSA-6g88-vr3v-76mf
Limnoria Source Repository REPOSITORY
https://github.com/pypa/advisory-database/tree/main/vulns/limnoria/PYSEC-2019-102.yaml
lists.fedoraproject.org/archives/list/packa... WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/54CQM2TEXRADLE77VOMCPHL5PBHR3ZWJ
lists.fedoraproject.org/archives/list/packa... WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5P2AGND54UIJV3WHOYO2YINIXSDGAAPO
lists.fedoraproject.org/archives/list/packa... WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DRNOUHFEN75QAIKT4Y3HDN3TT5LSIWN2

Frequently Asked Questions

What is CVE-2019-19010?
CVE-2019-19010 is a security vulnerability in Limnoria involving Eval injection in Supybot/Limnoria under CWE-94: Improper Control of Generation of Code ('Code Injection').
Which Limnoria versions are affected?
Affected versions include releases prior to 2019.11.09 across affected packages: limnoria.
What version fixes CVE-2019-19010?
Upgrading to 2019.11.09 (or the latest patched release for your respective branch) resolves the vulnerability.
Is limnoria affected?
Yes, limnoria is affected in releases prior to 2019.11.09. Upgrade your dependency to 2019.11.09 or later.
What is the CVSS score of CVE-2019-19010?
CVE-2019-19010 has a CVSS v3.1 base score of 9.8 (CRITICAL) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
What CWE is associated with CVE-2019-19010?
CVE-2019-19010 is classified under CWE-94: Improper Control of Generation of Code ('Code Injection') (The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.).
How can I check PyPI dependencies for CVE-2019-19010?
Run the dependency tree command: 'pip show limnoria'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-6g88-vr3v-76mf",
  "modified" : "2024-09-30T16:22:02Z",
  "published" : "2019-11-20T01:31:31Z",
  "aliases" : [ "CVE-2019-19010" ],
  "summary" : "Eval injection in Supybot/Limnoria",
  "details" : "Eval injection in the Math plugin of Limnoria (before 2019.11.09) and Supybot (through 2018-05-09) allows remote unprivileged attackers to disclose information or possibly have unspecified other impact via the calc and icalc IRC commands.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  }, {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "limnoria"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2019.11.09"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2019-19010"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/ProgVal/Limnoria/commit/3848ae78de45b35c029cc333963d436b9d2f0a35"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/ProgVal/Limnoria"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/ProgVal/Limnoria/wiki/math-eval-vulnerability"
  }, {
    "type" : "ADVISORY",
    "url" : "https://github.com/advisories/GHSA-6g88-vr3v-76mf"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/pypa/advisory-database/tree/main/vulns/limnoria/PYSEC-2019-102.yaml"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/54CQM2TEXRADLE77VOMCPHL5PBHR3ZWJ"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5P2AGND54UIJV3WHOYO2YINIXSDGAAPO"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DRNOUHFEN75QAIKT4Y3HDN3TT5LSIWN2"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-94" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2019-11-18T18:01:34Z",
    "nvd_published_at" : null
  }
}