PyPI/unoconv CVE-2019-17400: unknown, EPSS 2.16%

The unoconv package before 0.9 mishandles untrusted pathnames, leading to SSRF and local file inclusion.

Action: Upgrade unoconv to 0.9.0 or later.

pip install unoconv==0.9.0

Affected

Fixed versions

Sources

• osv: PYSEC-2019-213
• https://github.com/unoconv/unoconv/pull/510
• https://buer.haus/2019/10/18/a-tale-of-exploitation-in-spreadsheet-file-conversions/
• https://github.com/advisories/GHSA-27p5-7cw6-m45h

CVE-2019-17400 · published 2019-10-21T23:15:00Z · modified 2023-11-08T04:01:23.639213Z · JSON