GHSA-x3cp-4x6w-vm7p
Duplicate Advisory: Open Babel has out-of-bounds write in MOL2 attribute/value parser
- Severity
- 9.8 / 10
- Critical · CVSS 3.1
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-824 Access of Uninitialized Pointer
- Fix
3.2.0- Upgrade openbabel to this version or later
Description
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-jr2x-6qf6-q5mc. This link is maintained to preserve external references.
Original Description
A use of uninitialized pointer vulnerability exists in the MSI format atom functionality of Open Babel 3.1.1 and master commit 530dbfa3. A specially crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
Affected versions
PyPI
| Package | Vulnerable | Fixed in |
|---|---|---|
| openbabel | < 3.2.0 |
3.2.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
openbabel PyPI → 3.2.0
- pip
pip install --upgrade "openbabel>=3.2.0"- poetry
poetry add "openbabel>=3.2.0"- uv
uv add "openbabel>=3.2.0"
Severity breakdown
CVSS 3.1 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-824: Access of Uninitialized Pointer
The product accesses or uses a pointer that has not been initialized.
References
Advisories
Other links
Timeline
- Published
- Withdrawn
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-55f6-pf8r-c2f4 Open Babel has out-of-bounds write in MOPAC translationVectors[] (UNIT CELL TRANSLATION) | High | Also affects openbabel |
| GHSA-f8h2-c479-vqxf Open Babel has out-of-bounds write in MSI translationVectors[] | High | Also affects openbabel |
| GHSA-mjmg-352j-f456 Open Babel has out-of-bounds write in MOPAC IN translationVectors[] (Tv atom) | High | Also affects openbabel |
| GHSA-7h6r-6p76-68c9 Open Babel has out-of-bounds write in MOPAC translationVectors[] (FINAL POINT) | High | Also affects openbabel |
| GHSA-jg3h-pv7c-4f9c Open Babel has out-of-bounds write in Gaussian translationVectors[] | High | Also affects openbabel |
| GHSA-5rff-8f7c-8jmw Open Babel has out-of-bounds write in ORCA nAtoms parser (second variant) | High | Also affects openbabel |
| GHSA-rj4c-r689-cm87 Open Babel has out-of-bounds write in ORCA nAtoms parser | High | Also affects openbabel |
| GHSA-8qxc-57hf-hc9j Open Babel has uninitialized pointer dereference in PQS pFormat | High | Also affects openbabel |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor