VulnerabilityModified
CVE-2019-10800
The vulnerability occurs due to not sanitizing gcov arguments before being being provided to the popen method.
MEDIUM 6.5EPSS 1.18%
Does this matter?
Lower severity and a low EPSS score (1.18%). Track it; it rarely justifies an emergency change on its own.
Description
This affects the package codecov before 2.0.16. The vulnerability occurs due to not sanitizing gcov arguments before being being provided to the popen method.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 1.18% probability · 66th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-88
- Affected
- codecov/codecov-python
- Source
- report@snyk.io
References
- https://github.com/codecov/codecov-python/commit/2a80aa434f74feb31242b6f213b75ce63ae97902Patch, Third Party Advisory
- https://snyk.io/vuln/SNYK-PYTHON-CODECOV-552149Exploit, Third Party Advisory
- https://github.com/codecov/codecov-python/commit/2a80aa434f74feb31242b6f213b75ce63ae97902Patch, Third Party Advisory
- https://snyk.io/vuln/SNYK-PYTHON-CODECOV-552149Exploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.