CVE-2020-17353 – This vulnerability in LilyPond allows arbitrary... (How to Fix)

Q: What is the severity of CVE-2020-17353?

CVE-2020-17353 has a CVSS score of 9.8 (CRITICAL). This vulnerability in LilyPond allows arbitrary code execution when processing malicious music scores with embedded PostScript or SVG content, even when using the -dsafe security flag. Attackers can craft malicious files that execute arbitrary commands on the system. Users who process untrusted LilyPond files with affected versions are at risk.

📋 TL;DR

This vulnerability in LilyPond allows arbitrary code execution when processing malicious music scores with embedded PostScript or SVG content, even when using the -dsafe security flag. Attackers can craft malicious files that execute arbitrary commands on the system. Users who process untrusted LilyPond files with affected versions are at risk.

💻 Affected Systems

Products:

LilyPond

Versions: Through 2.20.0 and 2.21.x through 2.21.4

Operating Systems: Linux, Windows, macOS

Default Config Vulnerable: ⚠️ Yes

Notes: Vulnerability exists even when using -dsafe flag, which is intended to provide security restrictions.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full system compromise with remote code execution, allowing attackers to install malware, exfiltrate data, or pivot to other systems.

🟠

Likely Case

Local privilege escalation or arbitrary code execution when processing malicious LilyPond files from untrusted sources.

🟢

If Mitigated

Limited impact if systems only process trusted files and have proper sandboxing/isolation.

🌐 Internet-Facing: MEDIUM - Risk exists if LilyPond processes user-uploaded files via web applications, but direct internet exposure is uncommon.

🏢 Internal Only: HIGH - Internal users processing untrusted LilyPond files (e.g., from email, shared drives) could trigger exploitation.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW - Requires user to open/process a malicious LilyPond file.

Exploitation requires user interaction to process a malicious file. No public exploit code identified in references.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.20.1, 2.21.5, and later versions

Vendor Advisory: http://git.savannah.gnu.org/gitweb/?p=lilypond.git%3Ba=commit%3Bh=b84ea4740f3279516905c5db05f4074e777c16ff

Restart Required: No

Instructions:

1. Update LilyPond to version 2.20.1 or 2.21.5 or later. 2. Use package manager: 'sudo apt update && sudo apt upgrade lilypond' (Debian/Ubuntu) or 'sudo yum update lilypond' (RHEL/CentOS). 3. For source installations, download and compile from official repository.

🔧 Temporary Workarounds

Disable embedded PostScript/SVG processing

all

Modify LilyPond configuration to block embedded PostScript and SVG commands

Edit scm/define-stencil-commands.scm to add restrictions on embedded-ps and embedded-svg

Sandbox LilyPond processing

linux

Run LilyPond in isolated containers or virtual machines when processing untrusted files

docker run --rm -v $(pwd):/data lilypond lilypond input.ly
Use bubblewrap or firejail for isolation

🧯 If You Can't Patch

Only process LilyPond files from trusted sources and avoid opening untrusted .ly files
Implement strict file upload validation in web applications to reject potentially malicious LilyPond files

🔍 How to Verify

Check if Vulnerable:

Check LilyPond version: 'lilypond --version' and verify if it's 2.20.0 or earlier, or 2.21.0-2.21.4

Check Version:

lilypond --version | head -1

Verify Fix Applied:

After update, run 'lilypond --version' and confirm version is 2.20.1, 2.21.5, or later

📡 Detection & Monitoring

Log Indicators:

Unusual LilyPond process execution patterns
Errors related to embedded PostScript/SVG processing

Network Indicators:

Outbound connections from LilyPond processes to unexpected destinations

SIEM Query:

process_name:"lilypond" AND (command_line:"-dsafe" OR parent_process:web_server)

📊 Metadata

CVE ID: CVE-2020-17353

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Published: August 5, 2020

Last Updated: November 21, 2024

🔗 References

http://git.savannah.gnu.org/gitweb/?p=lilypond.git%3Ba=commit%3Bh=b84ea4740f3279516905c5db05f4074e777c16ff
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00064.html Mailing List,Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00076.html Mailing List,Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QG2JUV4UTIA27JUE6IZLCEFP5PYSFPF4/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W2JYMVLTPSNYS5F7TBHKIXUZZJIJAMRX/
https://www.debian.org/security/2020/dsa-4756 Third Party Advisory
http://git.savannah.gnu.org/gitweb/?p=lilypond.git%3Ba=commit%3Bh=b84ea4740f3279516905c5db05f4074e777c16ff
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00064.html Mailing List,Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00076.html Mailing List,Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QG2JUV4UTIA27JUE6IZLCEFP5PYSFPF4/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W2JYMVLTPSNYS5F7TBHKIXUZZJIJAMRX/
https://www.debian.org/security/2020/dsa-4756 Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON