Eclipse ESMF model loader path limits flaw exposes files outside models folder (py-aspect-model-loader)
A crafted model file can pull in contents from other folders!
Summary
A crafted model file can make the py-aspect-model-loader in Eclipse ESMF, versions 2.1.2 to 2.2.1, read .ttl files from folders outside the intended models root and merge them into the result. Anyone who loads Aspect Models with this loader is affected.
Affected when
- Loader reads a crafted model file
- py-aspect-model-loader 2.1.2 or later, up to 2.2.1
What to do
Versions up to 2.2.1 are affected, so check that the installed version is newer than 2.2.1 and read the vendor's advisory. No fixed version is named in the sources.
Products and platforms
CVE IDs
Times
First published
First seen