Bug 2294734 (CVE-2024-38526) - CVE-2024-38526 pdoc: pdoc embeds link to malicious CDN if math mode is enabled [NEEDINFO]
Summary: CVE-2024-38526 pdoc: pdoc embeds link to malicious CDN if math mode is enabled
Keywords:
Status: NEW
Alias: CVE-2024-38526
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2294735 2294736
Blocks: 2294733
TreeView+ depends on / blocked
 
Reported: 2024-06-28 19:00 UTC by Patrick Del Bello
Modified: 2024-09-27 12:50 UTC (History)
0 users

Fixed In Version: pdoc 14.5.1
Clone Of:
Environment:
Last Closed:
Embargoed:
pnemade: needinfo? (pdelbell)

Attachments (Terms of Use)

Description Patrick Del Bello 2024-06-28 19:00:34 UTC 
pdoc provides API Documentation for Python Projects. Documentation generated with `pdoc --math` linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code. This issue has been fixed in pdoc 14.5.1.

https://github.com/mitmproxy/pdoc/pull/703
https://github.com/mitmproxy/pdoc/security/advisories/GHSA-5vgj-ggm4-fg62
https://sansec.io/research/polyfill-supply-chain-attack
Comment 1 Patrick Del Bello 2024-06-28 19:01:28 UTC 
Created python-munkres tracking bugs for this issue:

Affects: epel-all [bug 2294735]
Affects: fedora-all [bug 2294736]
Comment 3 Parag Nemade 2024-06-29 05:06:19 UTC 
May I know what is the relation of this pdoc project to python-munkres?
And Does Fedora uses pdoc or do we have pdoc packaged in Fedora?
Comment 4 Fabian Affolter 2024-09-27 12:49:15 UTC 
Upstream is not aware of an issue regarding CVE-2024-38526 -> https://github.com/bmc/munkres/issues
Note You need to log in before you can comment on or make changes to this bug.