CVE-2024-29189

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-29189
PyAnsys Geometry is a Python client library for the Ansys Geometry service and other CAD Ansys products. On file src/ansys/geometry/core/connection/product_instance.py, upon calling this method _start_program directly, users could exploit its usage to perform malicious operations on the current machine where the script is ran. This vulnerability is fixed in 0.3.3 and 0.4.12.

7.4 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.4 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://bandit.readthedocs.io/en/1.7.8/plugins/b602_subprocess_popen_with_shell_equals_true.html Technical Description
https://github.com/ansys/pyansys-geometry/blob/52cba1737a8a7812e5430099f715fa2160ec007b/src/ansys/geometry/core/connection/product_instance.py#L403-L428 Patch
https://github.com/ansys/pyansys-geometry/commit/902071701c4f3a8258cbaa46c28dc0a65442d1bc Patch
https://github.com/ansys/pyansys-geometry/commit/f82346b9432b06532e84f3278125f5879b4e9f3f Patch
https://github.com/ansys/pyansys-geometry/pull/1076 Issue Tracking
https://github.com/ansys/pyansys-geometry/pull/1077 Issue Tracking
https://github.com/ansys/pyansys-geometry/security/advisories/GHSA-38jr-29fh-w9vm Exploit Vendor Advisory
https://bandit.readthedocs.io/en/1.7.8/plugins/b602_subprocess_popen_with_shell_equals_true.html Technical Description
https://github.com/ansys/pyansys-geometry/blob/52cba1737a8a7812e5430099f715fa2160ec007b/src/ansys/geometry/core/connection/product_instance.py#L403-L428 Patch
https://github.com/ansys/pyansys-geometry/commit/902071701c4f3a8258cbaa46c28dc0a65442d1bc Patch
https://github.com/ansys/pyansys-geometry/commit/f82346b9432b06532e84f3278125f5879b4e9f3f Patch
https://github.com/ansys/pyansys-geometry/pull/1076 Issue Tracking
https://github.com/ansys/pyansys-geometry/pull/1077 Issue Tracking
https://github.com/ansys/pyansys-geometry/security/advisories/GHSA-38jr-29fh-w9vm Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:ansys:pyansys_geometry:*:*:*:*:*:*:*:*
cpe:2.3:a:ansys:pyansys_geometry:*:*:*:*:*:*:*:*
History

15 Dec 2025, 21:38

Type Values Removed Values Added
CPE cpe:2.3:a:ansys:pyansys_geometry:*:*:*:*:*:*:*:*
First Time Ansys pyansys Geometry
Ansys
References () https://bandit.readthedocs.io/en/1.7.8/plugins/b602_subprocess_popen_with_shell_equals_true.html - () https://bandit.readthedocs.io/en/1.7.8/plugins/b602_subprocess_popen_with_shell_equals_true.html - Technical Description
References () https://github.com/ansys/pyansys-geometry/blob/52cba1737a8a7812e5430099f715fa2160ec007b/src/ansys/geometry/core/connection/product_instance.py#L403-L428 - () https://github.com/ansys/pyansys-geometry/blob/52cba1737a8a7812e5430099f715fa2160ec007b/src/ansys/geometry/core/connection/product_instance.py#L403-L428 - Patch
References () https://github.com/ansys/pyansys-geometry/commit/902071701c4f3a8258cbaa46c28dc0a65442d1bc - () https://github.com/ansys/pyansys-geometry/commit/902071701c4f3a8258cbaa46c28dc0a65442d1bc - Patch
References () https://github.com/ansys/pyansys-geometry/commit/f82346b9432b06532e84f3278125f5879b4e9f3f - () https://github.com/ansys/pyansys-geometry/commit/f82346b9432b06532e84f3278125f5879b4e9f3f - Patch
References () https://github.com/ansys/pyansys-geometry/pull/1076 - () https://github.com/ansys/pyansys-geometry/pull/1076 - Issue Tracking
References () https://github.com/ansys/pyansys-geometry/pull/1077 - () https://github.com/ansys/pyansys-geometry/pull/1077 - Issue Tracking
References () https://github.com/ansys/pyansys-geometry/security/advisories/GHSA-38jr-29fh-w9vm - () https://github.com/ansys/pyansys-geometry/security/advisories/GHSA-38jr-29fh-w9vm - Exploit, Vendor Advisory

21 Nov 2024, 09:07

Type Values Removed Values Added
References () https://bandit.readthedocs.io/en/1.7.8/plugins/b602_subprocess_popen_with_shell_equals_true.html - () https://bandit.readthedocs.io/en/1.7.8/plugins/b602_subprocess_popen_with_shell_equals_true.html -
References () https://github.com/ansys/pyansys-geometry/blob/52cba1737a8a7812e5430099f715fa2160ec007b/src/ansys/geometry/core/connection/product_instance.py#L403-L428 - () https://github.com/ansys/pyansys-geometry/blob/52cba1737a8a7812e5430099f715fa2160ec007b/src/ansys/geometry/core/connection/product_instance.py#L403-L428 -
References () https://github.com/ansys/pyansys-geometry/commit/902071701c4f3a8258cbaa46c28dc0a65442d1bc - () https://github.com/ansys/pyansys-geometry/commit/902071701c4f3a8258cbaa46c28dc0a65442d1bc -
References () https://github.com/ansys/pyansys-geometry/commit/f82346b9432b06532e84f3278125f5879b4e9f3f - () https://github.com/ansys/pyansys-geometry/commit/f82346b9432b06532e84f3278125f5879b4e9f3f -
References () https://github.com/ansys/pyansys-geometry/pull/1076 - () https://github.com/ansys/pyansys-geometry/pull/1076 -
References () https://github.com/ansys/pyansys-geometry/pull/1077 - () https://github.com/ansys/pyansys-geometry/pull/1077 -
References () https://github.com/ansys/pyansys-geometry/security/advisories/GHSA-38jr-29fh-w9vm - () https://github.com/ansys/pyansys-geometry/security/advisories/GHSA-38jr-29fh-w9vm -

26 Mar 2024, 03:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-03-26 03:15

Updated : 2025-12-15 21:38

NVD link : CVE-2024-29189

Mitre link : CVE-2024-29189

CVE.ORG link : CVE-2024-29189

JSON object : View

Products Affected

ansys

  • pyansys_geometry
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')