{"id":"CVE-2021-33633","aliases":["EUVD-2021-20310","GHSA-j32f-6x6r-56fq","OESA-2024-1159"],"status":"published","title":"Command Injection in aops-ceres","description":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in openEuler aops-ceres on Linux allows Command Injection. This vulnerability is associated with program files ceres/function/util.Py.\n\nThis issue affects aops-ceres: from 1.3.0 through 1.4.1.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00778,"percentile":0.56191,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78"],"published":"2024-02-08T11:06:36Z","modified":"2026-08-18T01:18:15Z","fixes":[{"ecosystem":"openEuler:20.03-LTS-SP4","package":"aops-ceres","fixed_in":["v1.3.4-14.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"aops-ceres","fixed_in":["v1.4.1-6.oe2203sp3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"aops-ceres","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"v1.3.4-14.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"aops-ceres","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"v1.4.1-6.oe2203sp3"}]}]}],"products":[{"vendor":"openeuler","product":"aops-ceres"},{"vendor":"openeuler","product":"aops-zeus"}],"references":[{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1159","tags":["x_transferred"]},{"url":"https://gitee.com/src-openeuler/aops-ceres/pulls/159","tags":["x_transferred"]},{"url":"https://gitee.com/src-openeuler/aops-ceres/pulls/158","tags":["x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33633","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-j32f-6x6r-56fq"},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1159","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-33633","title":"Command Injection in aops-ceres","description":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in openEuler aops-ceres on Linux allows Command Injection. This vulnerability is associated with program files ceres/function/util.Py.\n\nThis issue affects aops-ceres: from 1.3.0 through 1.4.1.\n\n","status":"published","published":"2024-03-23T11:29:44.343Z","modified":"2024-08-12T18:42:35.811Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:33:10.204494Z"}],"euvd":[{"id":"EUVD-2021-20310","description":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in openEuler aops-ceres on Linux allows Command Injection. This vulnerability is associated with program files ceres/function/util.Py.\n\nThis issue affects aops-ceres: from 1.3.0 through 1.4.1.\n\n","status":"published","published":"2024-03-23T11:29:44Z","modified":"2024-08-12T18:42:35Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:56:19.748102Z"}],"ghsa":[{"id":"GHSA-j32f-6x6r-56fq","title":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')...","description":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in openEuler aops-ceres on Linux allows Command Injection. This vulnerability is associated with program files ceres/function/util.Py.\n\nThis issue affects aops-ceres: from 1.3.0 through 1.4.1.\n\n","status":"published","published":"2024-03-23T12:30:28Z","modified":"2024-03-23T12:30:33Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:55:43.067988Z"}],"nvd":[{"id":"CVE-2021-33633","description":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in openEuler aops-ceres on Linux allows Command Injection. This vulnerability is associated with program files ceres/function/util.Py.\n\nThis issue affects aops-ceres: from 1.3.0 through 1.4.1.\n\n","status":"published","published":"2024-03-23T12:15:07.993Z","modified":"2026-06-17T03:54:54.337Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:07:08.163458Z"}],"osv":[{"id":"OESA-2024-1159","title":"aops-ceres security update","description":"An agent which needs to be adopted in client, it managers some plugins, such as gala-gopher(kpi collection), fluentd(log collection) and so on.\r\n\r\nSecurity Fix(es):\r\nIn versions 1.3.0-1.4.1 of the ceres software package, the execute_shell_command function does not properly verify or filter the command or subcommand parameters entered by users. This allows an attacker to exploit the vulnerability by injecting malicious code and execute arbitrary commands locally. Attackers can exploit this vulnerability to perform unauthorized operations, which may cause severe security threats and losses to the system.(CVE-2021-33633)","status":"published","published":"2024-02-08T11:06:36Z","modified":"2026-08-18T01:18:15.134005182Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"}]}}