id: PYSEC-2022-42999
details: '** DISPUTED ** In the python-libnmap package through 0.7.2 for Python, remote
  command execution can occur (if used in a client application that does not validate
  arguments). NOTE: the vendor believes it would be unrealistic for an application
  to call NmapProcess with arguments taken from input data that arrived over an untrusted
  network, and thus the CVSS score corresponds to an unrealistic use case. None of
  the NmapProcess documentation implies that this is an expected use case.'
aliases:
- CVE-2022-30284
- GHSA-qwqv-j7jr-4hp6
modified: '2023-05-04T04:29:28.652969Z'
published: '2022-05-04T22:15:00Z'
references:
- type: WEB
  url: https://github.com/savon-noir/python-libnmap/releases
- type: EVIDENCE
  url: https://www.swascan.com/security-advisory-libnmap-2/
- type: ADVISORY
  url: https://www.swascan.com/security-advisory-libnmap-2/
- type: PACKAGE
  url: https://pypi.org/project/python-libnmap/
- type: EVIDENCE
  url: https://libnmap.readthedocs.io/en/latest/process.html#using-libnmap-process
- type: WEB
  url: https://libnmap.readthedocs.io/en/latest/process.html#using-libnmap-process
- type: ADVISORY
  url: https://github.com/advisories/GHSA-qwqv-j7jr-4hp6
affected:
- package:
    name: python-libnmap
    ecosystem: PyPI
    purl: pkg:pypi/python-libnmap
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: '0'
    - fixed: 0.7.3
  versions:
  - 0.2.3
  - 0.2.4
  - 0.2.7
  - 0.2.8
  - 0.4.0
  - 0.4.6
  - 0.5.0
  - 0.5.1
  - '0.6'
  - 0.6.1
  - 0.6.2
  - 0.6.3
  - 0.7.0
  - 0.7.2