{"action":"closed","issue":{"url":"https://api.github.com/repos/achim1/ctplot/issues/34","labels_url":"https://api.github.com/repos/achim1/ctplot/issues/34/labels{/name}","comments_url":"https://api.github.com/repos/achim1/ctplot/issues/34/comments","events_url":"https://api.github.com/repos/achim1/ctplot/issues/34/events","html_url":"https://github.com/achim1/ctplot/issues/34","id":120916057,"number":34,"title":"CRITICAL: remote code execution via eval","user":{"login":"martinohmann","id":1335045,"avatar_url":"https://avatars.githubusercontent.com/u/1335045?v=3","gravatar_id":"","url":"https://api.github.com/users/martinohmann","html_url":"https://github.com/martinohmann","followers_url":"https://api.github.com/users/martinohmann/followers","following_url":"https://api.github.com/users/martinohmann/following{/other_user}","gists_url":"https://api.github.com/users/martinohmann/gists{/gist_id}","starred_url":"https://api.github.com/users/martinohmann/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/martinohmann/subscriptions","organizations_url":"https://api.github.com/users/martinohmann/orgs","repos_url":"https://api.github.com/users/martinohmann/repos","events_url":"https://api.github.com/users/martinohmann/events{/privacy}","received_events_url":"https://api.github.com/users/martinohmann/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/achim1/ctplot/labels/bug","name":"bug","color":"fc2929"}],"state":"closed","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/achim1/ctplot/milestones/1","html_url":"https://github.com/achim1/ctplot/milestones/Milestone%202","labels_url":"https://api.github.com/repos/achim1/ctplot/milestones/1/labels","id":1444842,"number":1,"title":"Milestone 2","description":null,"creator":{"login":"caroschwerdt","id":13692433,"avatar_url":"https://avatars.githubusercontent.com/u/13692433?v=3","gravatar_id":"","url":"https://api.github.com/users/caroschwerdt","html_url":"https://github.com/caroschwerdt","followers_url":"https://api.github.com/users/caroschwerdt/followers","following_url":"https://api.github.com/users/caroschwerdt/following{/other_user}","gists_url":"https://api.github.com/users/caroschwerdt/gists{/gist_id}","starred_url":"https://api.github.com/users/caroschwerdt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/caroschwerdt/subscriptions","organizations_url":"https://api.github.com/users/caroschwerdt/orgs","repos_url":"https://api.github.com/users/caroschwerdt/repos","events_url":"https://api.github.com/users/caroschwerdt/events{/privacy}","received_events_url":"https://api.github.com/users/caroschwerdt/received_events","type":"User","site_admin":false},"open_issues":8,"closed_issues":9,"state":"open","created_at":"2015-12-04T20:03:42Z","updated_at":"2015-12-09T16:25:38Z","due_on":null,"closed_at":null},"comments":0,"created_at":"2015-12-08T02:26:19Z","updated_at":"2015-12-09T16:25:38Z","closed_at":"2015-12-09T16:25:38Z","body":"Bestimmte Eingabefelder werden im Backend _ohne_ Überprüfung mittels `eval` ausgewertet.\r\n\r\nDie folgende Eingabe in bestimmte Felder öffnet eine Shell mit den Rechten des Nutzers unter dem ctplot läuft:\r\n```python\r\n__import__('os').system('/bin/bash')\r\n```\r\nDer Fehler ist sehr kritisch, da er das unterliegende System kompromittiert."}}