CVE-2023-41334: Insufficient Information (NVD-CWE-noinfo)
value: Astropy is a project for astronomy in Python that fosters interoperability between Python astronomy packages. Version 5.3.2 of the Astropy core package is vulnerable to remote code execution due to improper input validation in the `TranformGraph().to_dot_graph` function. A malicious user can provide a command or a script file as a value to the `savelayout` argument, which will be placed as the first value in a list of arguments passed to `subprocess.Popen`.  Although an error will be raised, the command or script will be executed successfully. Version 5.3.3 fixes this issue.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-18T19:15Z
Repository: https://github.com/astropy/astropy
Language: Python
Files changed: astropy/coordinates/transformations.py
Commit date: 2023-08-27 12:10:39 -0400
Commit message: MNT: Explicit option for savelayout in to_dot_graph

Diff: diff --git a/astropy/coordinates/transformations.py b/astropy/coordinates/transformations.py
index 6533d374e..c2e4bf6a6 100644
--- a/astropy/coordinates/transformations.py
+++ b/astropy/coordinates/transformations.py
@@ -490,11 +490,11 @@ class TransformGraph:
             Additional coordinate systems to add (this can include systems
             already in the transform graph, but they will only appear once).
         savefn : None or str
             The file name to save this graph to or `None` to not save
             to a file.
-        savelayout : str
+        savelayout : {"plain", "dot", "neato", "fdp", "sfdp", "circo", "twopi", "nop", "nop2", "osage", "patchwork"}
             The graphviz program to use to layout the graph (see
             graphviz_ for details) or 'plain' to just save the DOT graph
             content. Ignored if ``savefn`` is `None`.
         saveformat : str
             The graphviz output format. (e.g. the ``-Txxx`` option for
@@ -569,11 +569,23 @@ class TransformGraph:
 
         if savefn is not None:
             if savelayout == "plain":
                 with open(savefn, "w") as f:
                     f.write(dotgraph)
-            else:
+            # Options from https://graphviz.org/docs/layouts/
+            elif savelayout in (
+                "dot",
+                "neato",
+                "fdp",
+                "sfdp",
+                "circo",
+                "twopi",
+                "nop",
+                "nop2",
+                "osage",
+                "patchwork",
+            ):
                 args = [savelayout]
                 if saveformat is not None:
                     args.append("-T" + saveformat)
                 proc = subprocess.Popen(
                     args,
@@ -585,10 +597,12 @@ class TransformGraph:
                 if proc.returncode != 0:
                     raise OSError("problem running graphviz: \n" + stderr)
 
                 with open(savefn, "w") as f:
                     f.write(stdout)
+            else:
+                raise NotImplementedError(f'savelayout="{savelayout}" is not supported')
 
         return dotgraph
 
     def to_networkx_graph(self):
         """

Vulnerable code:         savelayout : str
            else:
Fixed code:         savelayout : {"plain", "dot", "neato", "fdp", "sfdp", "circo", "twopi", "nop", "nop2", "osage", "patchwork"}
            # Options from https://graphviz.org/docs/layouts/
            elif savelayout in (
                "dot",
                "neato",
                "fdp",
                "sfdp",
                "circo",
                "twopi",
                "nop",
                "nop2",
                "osage",
                "patchwork",
            ):
            else:
                raise NotImplementedError(f'savelayout="{savelayout}" is not supported')