—

PYSEC-2019-21

Quick fix

PYSEC-2019-21 — donfig: upgrade to the fixed version with the command below.

pip install --upgrade 'donfig>=0.4.0'

Details

An issue was discovered in Donfig 0.3.0. There is a vulnerability in the collect_yaml method in config_obj.py. It can execute arbitrary Python commands, resulting in command execution.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/donfig

Introduced in: 0Fixed in: 0.4.0

Fixpip install --upgrade 'donfig>=0.4.0'

References

https://github.com/pytroll/donfig/issues/5[REPORT]
https://github.com/pytroll/donfig/commits/master[WEB]
https://github.com/advisories/GHSA-3qr5-h7w4-3gx3[ADVISORY]