Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

cbpi4

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.8PyPIAmendedPublished

    CraftBeerPi 4 allows arbitrary code execution

    CVE-2024-3955 · GHSA-4f92-w438-f484

    Affected
    • PyPI cbpi4 >= 4.0.0.58, < 4.4.1a1
    Fixed in
    4.4.1a1· Vendor fix available
    Issue
    URL GET parameter "logtime" utilized within the "downloadlog" function from "cbpi/http_endpoints/http_system.py" is subsequently passed to the "os.system" function in "cbpi/controller/system_controller.py" without prior validation allowing arbitrary code execution. This issue affects CraftBeerPi 4: from 4.0.0.58 (commit 563fae9) before 4.4.1.a1 (commit 57572c7).

    Recommended action: Upgrade to 4.4.1a1 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →