Threat Intelligence Database

A vulnerability in the asteval library used by Checkov allows attackers controlling input to bypass sandbox restrictions and execute arbitrary Python code. This occurs due to unsafe handling of formatted string AST nodes, enabling crafted format strings to escape the sandbox. The flaw can be exploited to access protected attributes and execute system commands. A proof-of-concept demonstrates executing the 'whoami' command on the host. The vulnerability affects Checkov versions from 3.2.420 up to but not including 3.2.490. A patch is available to remediate this issue.

The llhttp library version 8.1.1 contains two request smuggling vulnerabilities. These vulnerabilities affect aiohttp versions prior to 3.8.6 because they include the vulnerable llhttp version. The vulnerabilities are resolved by upgrading to llhttp version 9 or later, which is included in aiohttp 3.8.6 and above. The affected product Checkov uses aiohttp versions from 2.0.615 up to but not including 2.5.10, which rely on the vulnerable llhttp version. No detailed technical information or exploitation details have been disclosed yet.

A vulnerability in the asteval library used by Checkov allows attackers who can control input to bypass safety checks and execute arbitrary Python code. The flaw arises because the attribute access verification can be circumvented by modifying AST nodes at runtime, exploiting a time-of-check to time-of-use (TOCTOU) issue. Specifically, the Procedure class exposes its AST in an unprotected attribute, enabling attackers to alter the AST and access dangerous dunder methods like __getattribute__. This leads to sandbox escape and arbitrary code execution within the application's context.

pycares versions prior to 4.2.0 contain a cross-site scripting (XSS) vulnerability identified as CVE-2021-3672. This vulnerability involves improper neutralization of input during web page generation, which can lead to limited confidentiality, integrity, and availability impacts. The issue is addressed by updating to pycares version 4.2.0 or later.