CVE-2021-33633
Command Injection in aops-ceres
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in openEuler aops-ceres on Linux allows Command Injection. This vulnerability is associated with program files ceres/function/util.Py.
This issue affects aops-ceres: from 1.3.0 through 1.4.1.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Command Injection in aops-ceres
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in openEuler aops-ceres on Linux allows Command Injection. This vulnerability is associated with program files ceres/function/util.Py.
This issue affects aops-ceres: from 1.3.0 through 1.4.1.
- Record
CVE-2021-33633- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
EUVDEUVD-2021-20310
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in openEuler aops-ceres on Linux allows Command Injection. This vulnerability is associated with program files ceres/function/util.Py.
This issue affects aops-ceres: from 1.3.0 through 1.4.1.
- Record
EUVD-2021-20310- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j32f-6x6r-56fq
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')...
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in openEuler aops-ceres on Linux allows Command Injection. This vulnerability is associated with program files ceres/function/util.Py.
This issue affects aops-ceres: from 1.3.0 through 1.4.1.
- Record
GHSA-j32f-6x6r-56fq- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
NVD
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in openEuler aops-ceres on Linux allows Command Injection. This vulnerability is associated with program files ceres/function/util.Py.
This issue affects aops-ceres: from 1.3.0 through 1.4.1.
- Record
CVE-2021-33633- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
OSVOESA-2024-1159
aops-ceres security update
An agent which needs to be adopted in client, it managers some plugins, such as gala-gopher(kpi collection), fluentd(log collection) and so on.
Security Fix(es): In versions 1.3.0-1.4.1 of the ceres software package, the execute_shell_command function does not properly verify or filter the command or subcommand parameters entered by users. This allows an attacker to exploit the vulnerability by injecting malicious code and execute arbitrary commands locally. Attackers can exploit this vulnerability to perform unauthorized operations, which may cause severe security threats and losses to the system.(CVE-2021-33633)
- Record
OESA-2024-1159- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
aops-ceresopenEuler:20.03-LTS-SP4 |
before v1.3.4-14.oe2003sp4 | v1.3.4-14.oe2003sp4 |
aops-ceresopenEuler:22.03-LTS-SP3 |
before v1.4.1-6.oe2203sp3 | v1.4.1-6.oe2203sp3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-33633 is a high vulnerability (CVSS 7.3) in Openeuler Aops-ceres, published February 8, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.78%, the 56th percentile. Fixed in aops-ceres v1.3.4-14.oe2003sp4.
References
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2024-1159
gitee.com/src-openeuler/aops-ceres/pulls/159
nvd.nist.gov/vuln/detail/CVE-2021-33633
github.com/advisories/GHSA-j32f-6x6r-56fq