Detections
Analytics

SCA: security update for ipython (GHSA-29gw-9793-fvw7)

low Tenable Cloud Security Plugin ID 408825

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - IPython (Interactive Python) is a command shell for interactive computing in multiple programming
 languages, originally developed for the Python programming language. Versions prior to 8.1.0 are subject
 to a command injection vulnerability with very specific prerequisites. This vulnerability requires that
 the function `IPython.utils.terminal.set_term_title` be called on Windows in a Python environment where
 ctypes is not available. The dependency on `ctypes` in `IPython.utils._process_win32` prevents the
 vulnerable code from ever being reached in the ipython binary. However, as a library that could be used by
 another tool `set_term_title` could be called and hence introduce a vulnerability. Should an attacker get
 untrusted input to an instance of this function they would be able to inject shell commands as current
 process and limited to the scope of the current process. Users of ipython as a library are advised to
 upgrade. Users unable to upgrade should ensure that any calls to the
 `IPython.utils.terminal.set_term_title` function are done with trusted or filtered input. (CVE-2023-24816)

See Also

https://github.com/advisories/GHSA-29gw-9793-fvw7

Plugin Details

Severity: Low

ID: 408825

Version: Revision 1.5

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 97.07

Vendor

Vendor Severity: Low

CVSS v2

Risk Factor: Medium

Base Score: 6.2

Temporal Score: 4.9

Vector: CVSS2#AV:L/AC:H/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2023-24816

CVSS v3

Risk Factor: High

Base Score: 7

Temporal Score: 6.3

Vector: CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: Low

Base Score: 2

Threat Score: 1.1

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2/10/2023

Vulnerability Publication Date: 2/10/2023

Reference Information

CVE: CVE-2023-24816