ReviewBoard and Djblets library are vulnerable to code execution

CRITICAL 9.8CVE-2013-4409 · GHSA-58h8-44mg-r43x · PYSEC-2019-175 · Published 04/11/2019 · updated 16/06/2026

In short

CVE-2013-4409 is a CRITICAL (CVSS 9.8) vulnerability affecting djblets, reviewboard, djblets (reviewboard).
Chance of exploitation in the next 30 days (EPSS): 3.6%, higher than 89.6% of all vulnerabilities.
Fix: update to 0.7.19, 0.6.30, 0.7.21, 1.7.15 or later.

Package	Affected versions	Patched versions
djblets PyPI	`≥ 0.7.0, < 0.7.19< 0.6.30< 0.7.21`	`0.7.190.6.300.7.21`
reviewboard PyPI	`< 1.7.15`	`1.7.15`
djblets reviewboard	`= 0.7.21`	No fix yet
review board reviewboard	`< 1.7.15`	`1.7.15`

Description

An eval() vulnerability exists in Python Software Foundation Djblets version before 0.6.30 and 0.7.0 before 0.7.19 and Beanbag Review Board before 1.7.15 when parsing JSON requests allowing an attacker to execute arbitrary Python code.

NVD description

An eval() vulnerability exists in Python Software Foundation Djblets 0.7.21 and Beanbag Review Board before 1.7.15 when parsing JSON requests.

References

nvd.nist.gov/vuln/detail/CVE-2013-4409 · ADVISORY
access.redhat.com/security/cve/cve-2013-4409 · WEB
bugzilla.redhat.com/show_bug.cgi · WEB
exchange.xforce.ibmcloud.com/vulnerabilities/88059 · WEB
djblets/djblets · PACKAGE
djblets/djblets · WEB
pypa/advisory-database · WEB
security-tracker.debian.org/tracker/CVE-2013-4409 · WEB
web.archive.org/web/20200228151135/https://www.securityfocus.com/bid/63029 · WEB
reviewboard.org/docs/releasenotes/reviewboard/1.7.15 · WEB
lists.fedoraproject.org/pipermail/package-announce/2013-November/120619.html · WEB

More vulnerabilities in djblets

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free