Severity

Low

Vendor

VMware Tanzu

Versions Affected

• Canonical Ubuntu 18.04

Description

Alexandre D'Hondt discovered that PyXDG did not properly sanitize input. An attacker could exploit this with a crafted .menu file to execute arbitrary code.

CVEs contained in this USN include: CVE-2019-12761

Affected VMware Products and Versions

Severity is low unless otherwise noted.

• Platform Automation Toolkit
  • 4.0.x versions prior to 4.0.13
  • 4.1.x versions prior to 4.1.13
  • 4.2.x versions prior to 4.2.8
  • 4.3.x versions prior to 4.3.5

Mitigation

Users of affected products are strongly encouraged to follow the mitigation below. Upgrade VMware Tanzu products that use earlier versions of CF components to new Tanzu releases using new versions linked above. On the Tanzu Network product page for each release, check the Depends On section and/or Release Notes for this information. Releases that have fixed this issue include:

• Platform Automation Toolkit
  • 4.0.13
  • 4.1.13
  • 4.2.8
  • 4.3.5

References

• https://people.canonical.com/~ubuntu-security/cve/CVE-2019-12761
• https://ubuntu.com/security/notices/USN-4700-1

History

2021-03-01: Initial vulnerability report published.