PyMdown Extensions is a set of extensions for the `Python-Markdown` markdown project. In affected versions an arbitrary file read is possible when using include file syntax. By using the syntax `--8<--"/etc/passwd"` or `--8<--"/proc/self/environ"` the content of these files will be rendered in the generated documentation. Additionally, a path relative to a specified, allowed base path can also be used to render the content of a file outside the specified base paths: `--8<-- "../../../../etc/passwd"`. Within the Snippets extension, there exists a `base_path` option but the implementation is vulnerable to Directory Traversal. The vulnerable section exists in `get_snippet_path(self, path)` lines 155 to 174 in snippets.py. Any readable file on the host where the plugin is executing may have its content exposed. This can impact any use of Snippets that exposes the use of Snippets to external users. It is never recommended to use Snippets to process user-facing, dynamic content. It is designed to process known content on the backend under the control of the host, but if someone were to accidentally enable it for user-facing content, undesired information could be exposed. This issue has been addressed in version 10.0. Users are advised to upgrade. Users unable to upgrade may restrict relative paths by filtering input.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - PyMdown Extensions is a set of extensions for the `Python-Markdown` markdown project. In affected versions     an arbitrary file read is possible when using include file syntax. By using the syntax     `--8<--/etc/passwd` or `--8<--/proc/self/environ` the content of these files will be rendered in the     generated documentation. Additionally, a path relative to a specified, allowed base path can also be used     to render the content of a file outside the specified base paths: `--8<-- ../../../../etc/passwd`.
    Within the Snippets extension, there exists a `base_path` option but the implementation is vulnerable to     Directory Traversal. The vulnerable section exists in `get_snippet_path(self, path)` lines 155 to 174 in     snippets.py. Any readable file on the host where the plugin is executing may have its content exposed.
    This can impact any use of Snippets that exposes the use of Snippets to external users. It is never     recommended to use Snippets to process user-facing, dynamic content. It is designed to process known     content on the backend under the control of the host, but if someone were to accidentally enable it for     user-facing content, undesired information could be exposed. This issue has been addressed in version     10.0. Users are advised to upgrade. Users unable to upgrade may restrict relative paths by filtering     input. (CVE-2023-32309)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - PyMdown Extensions is a set of extensions for the `Python-Markdown` markdown project. In affected versions
    an arbitrary file read is possible when using include file syntax. By using the syntax
    `--8<--"/etc/passwd"` or `--8<--"/proc/self/environ"` the content of these files will be rendered in the
    generated documentation. Additionally, a path relative to a specified, allowed base path can also be used
    to render the content of a file outside the specified base paths: `--8<-- "../../../../etc/passwd"`.
    Within the Snippets extension, there exists a `base_path` option but the implementation is vulnerable to
    Directory Traversal. The vulnerable section exists in `get_snippet_path(self, path)` lines 155 to 174 in
    snippets.py. Any readable file on the host where the plugin is executing may have its content exposed.
    This can impact any use of Snippets that exposes the use of Snippets to external users. It is never
    recommended to use Snippets to process user-facing, dynamic content. It is designed to process known
    content on the backend under the control of the host, but if someone were to accidentally enable it for
    user-facing content, undesired information could be exposed. This issue has been addressed in version
    10.0. Users are advised to upgrade. Users unable to upgrade may restrict relative paths by filtering
    input. (CVE-2023-32309)

ID	Name	Product	Family	Type	Severity
327784	Linux Distros Unpatched Vulnerability : CVE-2023-32309	Nessus	Misc.	Local	high
416385	SCA: security update for pymdown-extensions (GHSA-jh85-wwv9-24hv)	Tenable Cloud Security	SCA Checks	Local	high
416385	SCA: security update for pymdown-extensions (GHSA-jh85-wwv9-24hv)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2023-32309

high

Tenable Plugins

high

high

high