CVE-2024-29189 (published 2024-03-26T03:15Z)

PyAnsys Geometry is a Python client library for the Ansys Geometry service and other CAD Ansys products. On file src/ansys/geometry/core/connection/product_instance.py, upon calling this method _start_program directly, users could exploit its usage to perform malicious operations on the current machine where the script is ran. This vulnerability is fixed in 0.3.3 and 0.4.12.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/ansys/pyansys-geometry
commit_details: repo_url: https://github.com/ansys/pyansys-geometry
author: Roberto Pastor Muela
author_date: 2024-03-22 08:32:20+01:00
msg: feat: accept bandit advisories in-line for subprocess (#1077)

Co-authored-by: pyansys-ci-bot <pyansys.github.bot@ansys.com>
repository: repo_url: https://github.com/ansys/pyansys-geometry
repo_name: ansys/pyansys-geometry
description: A Python wrapper for Ansys Geometry Services
repo_language: Python
owner: ansys
file_changes: filename: 1077.added.md
change_type: ModificationType.ADD
diff: @@ -0,0 +1 @@
+feat: accept bandit advisories in-line for subprocess
\ No newline at end of file

programming_language: Markdown
filename: product_instance.py
change_type: ModificationType.MODIFY
diff: @@ -23,7 +23,10 @@
 import os
 import signal
 import socket
-import subprocess
+
+# Subprocess is needed to start the backend. But
+# the input is controlled by the library. Excluding bandit check.
+import subprocess  # nosec B404
 
 from ansys.tools.path import get_available_ansys_installations, get_latest_ansys_installation
 from beartype.typing import TYPE_CHECKING, Dict, List
@@ -302,7 +305,7 @@ def prepare_and_start_backend(
     LOG.debug(f"Args: {args}")
     LOG.debug(f"Environment variables: {env_copy}")
 
-    instance = ProductInstance(_start_program(args, env_copy).pid)
+    instance = ProductInstance(__start_program(args, env_copy).pid)
 
     # Verify that the backend is ready to accept connections
     # before returning the Modeler instance.
@@ -403,7 +406,7 @@ def _manifest_path_provider(
         raise RuntimeError(msg)
 
 
-def _start_program(args: List[str], local_env: Dict[str, str]) -> subprocess.Popen:
+def __start_program(args: List[str], local_env: Dict[str, str]) -> subprocess.Popen:
     """
     Start the program where the path is the first item of the ``args`` array argument.
 
@@ -420,7 +423,8 @@ def _start_program(args: List[str], local_env: Dict[str, str]) -> subprocess.Pop
     subprocess.Popen
         The subprocess object.
     """
-    return subprocess.Popen(
+    # private method and controlled input by library - excluding bandit check.
+    return subprocess.Popen(  # nosec B603
         args,
         stdin=subprocess.DEVNULL,
         stdout=subprocess.DEVNULL,

programming_language: Python
repo_url: https://github.com/ansys/pyansys-geometry
commit_details: repo_url: https://github.com/ansys/pyansys-geometry
author: Roberto Pastor Muela
author_date: 2024-03-21 17:45:48+01:00
msg: fix: prepare_and_start_backend is only available on Windows (#1076)

Co-authored-by: pyansys-ci-bot <pyansys.github.bot@ansys.com>
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
repository: repo_url: https://github.com/ansys/pyansys-geometry
repo_name: ansys/pyansys-geometry
description: A Python wrapper for Ansys Geometry Services
repo_language: Python
owner: ansys
file_changes: filename: 1076.fixed.md
change_type: ModificationType.ADD
diff: @@ -0,0 +1 @@
+fix: prepare_and_start_backend is only available on Windows
\ No newline at end of file

programming_language: Batchfile
filename: product_instance.py
change_type: ModificationType.MODIFY
diff: @@ -241,6 +241,9 @@ def prepare_and_start_backend(
     """
     from ansys.geometry.core.modeler import Modeler
 
+    if os.name != "nt":  # pragma: no cover
+        raise RuntimeError("Method 'prepare_and_start_backend' is only available on Windows.")
+
     port = _check_port_or_get_one(port)
     installations = get_available_ansys_installations()
     if product_version != None:
@@ -419,7 +422,6 @@ def _start_program(args: List[str], local_env: Dict[str, str]) -> subprocess.Pop
     """
     return subprocess.Popen(
         args,
-        shell=os.name != "nt",
         stdin=subprocess.DEVNULL,
         stdout=subprocess.DEVNULL,
         stderr=subprocess.DEVNULL,

programming_language: Python