CVE-2019-7653
📋 TL;DR
This vulnerability allows local code injection in Debian's python-rdflib-tools package. Attackers can execute arbitrary Python code by placing malicious modules in the current working directory when CLI tools like rdf2dot are run. This affects Debian systems using the vulnerable package version.
💻 Affected Systems
- Debian python-rdflib-tools
📦 What is this software?
Rdflib by Rdflib Project
Ubuntu Linux by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via arbitrary code execution with the privileges of the user running the vulnerable CLI tool, potentially leading to privilege escalation.
Likely Case
Local privilege escalation or arbitrary code execution by malicious users with access to the system, particularly in multi-user environments.
If Mitigated
Limited impact if proper access controls restrict who can write to directories where CLI tools are executed.
🎯 Exploit Status
Exploitation requires local access and ability to place files in the current working directory where CLI tools are executed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.2.2-1+deb9u1 (Debian 9/stretch), 4.2.2-1+deb10u1 (Debian 10/buster)
Vendor Advisory: https://lists.debian.org/debian-lts-announce/2019/03/msg00019.html
Restart Required: No
Instructions:
1. Update package: sudo apt-get update && sudo apt-get install python-rdflib-tools
2. Verify version is patched: dpkg -l python-rdflib-tools
🔧 Temporary Workarounds
Remove vulnerable package
linuxUninstall python-rdflib-tools if not needed
sudo apt-get remove python-rdflib-tools
Restrict directory permissions
linuxEnsure users cannot write to directories where CLI tools are executed
chmod 755 /path/to/execution/directory
chown root:root /path/to/execution/directory
🧯 If You Can't Patch
- Remove python-rdflib-tools package entirely if not required
- Implement strict access controls to prevent users from writing to directories where CLI tools might be executed
🔍 How to Verify
Check if Vulnerable:
Check installed version: dpkg -l python-rdflib-tools | grep ^iiCheck Version:
dpkg -l python-rdflib-tools | grep ^ii | awk '{print $3}'Verify Fix Applied:
Verify version is 4.2.2-1+deb9u1 or later for Debian 9, or 4.2.2-1+deb10u1 or later for Debian 10📡 Detection & Monitoring
Log Indicators:
- Unusual Python module imports from current directory
- Execution of rdf2dot or other python-rdflib-tools CLI tools with suspicious parameters
Network Indicators:
- None - this is a local vulnerability
SIEM Query:
Process execution where command contains 'rdf2dot' or 'python -m' with unusual paths🔗 References
- https://bugs.debian.org/921751
- https://lists.debian.org/debian-lts-announce/2019/03/msg00019.html
- https://lists.debian.org/debian-lts-announce/2021/12/msg00026.html
- https://usn.ubuntu.com/4535-1/
- https://bugs.debian.org/921751
- https://lists.debian.org/debian-lts-announce/2019/03/msg00019.html
- https://lists.debian.org/debian-lts-announce/2021/12/msg00026.html
- https://usn.ubuntu.com/4535-1/
