VIR Vulnerability Intelligence Relay

CVE-2019-19010

unknown
Published 2019-11-20 · Modified 2023-11-08
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
—
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4 NEW
—
not yet in upstream
VIR risk
—

Description

Eval injection in the Math plugin of Limnoria (before 2019.11.09) and Supybot (through 2018-05-09) allows remote unprivileged attackers to disclose information or possibly have unspecified other impact via the calc and icalc IRC commands.

Predictions

Exploit likelihood
30%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

OS impact
debian Debian Fixed 5 releases
VersionStatusFixed in
trixie Fixed 2019.11.09-1
sid Fixed 2019.11.09-1
forky Fixed 2019.11.09-1
bullseye Fixed 2019.11.09-1
bookworm Fixed 2019.11.09-1

Package impact
EcosystemPackageVulnerableFixed
python PyPIlimnoria<2019.11.092019.11.09
python PyPIlimnoria<3848ae78de45b35c029cc333963d436b9d2f0a35||<2019.11.093848ae78de45b35c029cc333963d436b9d2f0a35

References

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.