An eval() vulnerability exists in Python Software Foundation Djblets 0.7.21 and Beanbag Review Board before 1.7.15 when parsing JSON requests.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An eval() vulnerability exists in Python Software Foundation Djblets 0.7.21 and Beanbag Review Board
    before 1.7.15 when parsing JSON requests. (CVE-2013-4409)

Review Board 1.6.19 and 1.7.15 fix a few issues in the API where users could access certain data they should not have been able to access, if using the Local Sites feature, invite-only groups, or private repositories. It also fixes cases with invite-only groups where the group name and list of private review requests would show up on some pages (though the review requests themselves were not accessible).

These issues do not affect most of the installations out there, but we strongly recommend upgrading anyway. There are no known cases of anyone exploiting these bugs, and in fact we discovered these internally while building new tools to test for security vulnerabilities in our codebase.

There are also some other bug fixes, and important changes needed for extensions that provide their own REST APIs.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
433579	SCA: security update for ReviewBoard, djblets (GHSA-58h8-44mg-r43x)	Tenable Cloud Security	SCA Checks	Local	critical
433579	SCA: security update for ReviewBoard, djblets (GHSA-58h8-44mg-r43x)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
70815	Fedora 20 : ReviewBoard-1.7.16-2.fc20 / python-djblets-0.7.21-1.fc20 (2013-18840)	Nessus	Fedora Local Security Checks	Local	medium
70666	Fedora 19 : ReviewBoard-1.7.16-2.fc19 / python-djblets-0.7.21-1.fc19 (2013-18931)	Nessus	Fedora Local Security Checks	Local	medium
70665	Fedora 18 : ReviewBoard-1.7.16-2.fc18 / python-djblets-0.7.21-1.fc18 (2013-18911)	Nessus	Fedora Local Security Checks	Local	medium

Detections

Analytics

CVE-2013-4409

critical

Tenable Plugins

critical

critical

medium

medium

medium