Improper input validation in Python Software Foundation; Beanbag Djblets
Priority MEDIUM 48CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
An eval() vulnerability exists in Python Software Foundation Djblets 0.7.21 and Beanbag Review Board before 1.7.15 when parsing JSON requests.
Why it matters now
EPSS 0.03649 89th percentileScored 2026-11-07
Fix Fixed Review Board (Python Software Foundation; Beanbag): 1.7.15djblets (PyPI): 0.6.30, 0.7.19+1 more product
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Python Software Foundation; Beanbag | Djblets | 0.7.21 | — | No fix listed | CNA |
| Python Software Foundation; Beanbag | Review Board | before 1.7.15 | 1.7.15 | Patch available | CNA |
| — | djblets (PyPI) | before 0.6.30 | 0.6.30 | Patch available | GHSA-58h8-44mg-r43x |
| — | djblets (PyPI) | 0.7.0 to before 0.7.19 | 0.7.19 | Patch available | GHSA-58h8-44mg-r43x |
| — | ReviewBoard (PyPI) | before 1.7.15 | 1.7.15 | Patch available | GHSA-58h8-44mg-r43x |
- Djblets VendorPython Software Foundation; Beanbag Affected 0.7.21 Fixed in — No fix listed CNA
- Review Board VendorPython Software Foundation; Beanbag Affected before 1.7.15 Fixed in 1.7.15 Patch available CNA
- djblets (PyPI) Vendor— Affected before 0.6.30 Fixed in 0.6.30 Patch available GHSA-58h8-44mg-r43x
- djblets (PyPI) Vendor— Affected 0.7.0 to before 0.7.19 Fixed in 0.7.19 Patch available GHSA-58h8-44mg-r43x
- ReviewBoard (PyPI) Vendor— Affected before 1.7.15 Fixed in 1.7.15 Patch available GHSA-58h8-44mg-r43x
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:reviewboard:djblets:0.7.21:*:*:*:*:*:*:* | 0.7.21 | Vulnerable | Review Board |
| cpe:2.3:a:reviewboard:review_board:*:*:*:*:*:*:*:* | before 1.7.15 | Vulnerable | Review Board |
| cpe:2.3:o:fedoraproject:fedora:18:*:*:*:*:*:*:* | 18 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:19:*:*:*:*:*:*:* | 19 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:20:*:*:*:*:*:*:* | 20 | Vulnerable | Fedoraproject |
| cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Red Hat |
- cpe:2.3:a:reviewboard:djblets:0.7.21:*:*:*:*:*:*:* Versions 0.7.21 Vulnerable ·Review Board
- cpe:2.3:a:reviewboard:review_board:*:*:*:*:*:*:*:* Versions before 1.7.15 Vulnerable ·Review Board
- cpe:2.3:o:fedoraproject:fedora:18:*:*:*:*:*:*:* Versions 18 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:19:*:*:*:*:*:*:* Versions 19 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:20:*:*:*:*:*:*:* Versions 20 Vulnerable ·Fedoraproject
- cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
Remediation
- Fix · CNA Review Board (Python Software Foundation; Beanbag) Fixed in 1.7.15
- Fix · GHSA-58h8-44mg-r43x djblets (PyPI) Fixed in 0.6.30 Advisory →
- Fix · GHSA-58h8-44mg-r43x djblets (PyPI) Fixed in 0.7.19 Advisory →
- Fix · GHSA-58h8-44mg-r43x ReviewBoard (PyPI) Fixed in 1.7.15 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2013-4409
- 2026-10-03 Alias added: GHSA-58h8-44mg-r43x
References
Advisory 8
- https://security-tracker.debian.org/tracker/CVE-2013-4409
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4409
- http://lists.fedoraproject.org/pipermail/package-announce/2013-October/119820.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-November/120619.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-October/119819.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-October/119830.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-October/119831.html
- https://nvd.nist.gov/vuln/detail/CVE-2013-4409
Other 6
- https://access.redhat.com/security/cve/cve-2013-4409
- https://github.com/djblets/djblets
- https://github.com/djblets/djblets/blob/release-0.7.19/NEWS
- https://github.com/pypa/advisory-database/tree/main/vulns/djblets/PYSEC-2019-175.yaml
- https://web.archive.org/web/20200228151135/https://www.securityfocus.com/bid/63029
- https://www.reviewboard.org/docs/releasenotes/reviewboard/1.7.15
Sources
- CVE-2013-4409 · CVE Program
- CVE-2013-4409 · NVD
- FIRST EPSS
- GHSA-58h8-44mg-r43x · GitHub Advisory Database · CC BY 4.0
- CVE-2013-4409 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences