{"id":"GHSA-67cx-rhhq-mfhq","aliases":[],"status":"published","title":"High severity vulnerability that affects indico","description":"## Local file disclosure through LaTeX injection\n\n### Impact\nAn external audit of the Indico codebase has discovered a vulnerability in Indico's LaTeX sanitization code, which could have malicious users to run unsafe LaTeX commands on the server. Such commands allowed for example to read local files (e.g. `indico.conf`).\n\nAs far as we know it is not possible to write files or execute code using this vulnerability.\n\n### Patches\nYou need to update to [Indico 2.2.3](https://github.com/indico/indico/releases/tag/v2.2.3) as soon as possible.\nWe also released [Indico 2.1.10](https://github.com/indico/indico/releases/tag/v2.1.10) in case you cannot update to 2.2 for some reason.\nSee https://docs.getindico.io/en/stable/installation/upgrade/ for instructions on how to update.\n\n### Workarounds\nSetting `XELATEX_PATH = None` in `indico.conf` will result in an error when building a PDF, but without being able to run xelatex, the vulnerability cannot be abused.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open a thread in [our forum](https://talk.getindico.io/)\n* Email us privately at [indico-team@cern.ch](mailto:indico-team@cern.ch)","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-77"],"published":"2019-10-11T18:28:07Z","modified":"2024-12-02T05:43:40Z","fixes":[{"ecosystem":"PyPI","package":"indico","fixed_in":["2.1.10","2.2.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"indico","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.10"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"indico","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.2.3"}]}]},{"source":"osv","ecosystem":"PyPI","package":"indico","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.10"}]}],"versions":["0.98-rc1","0.98.0","0.98.1","0.98.2","0.99","1.0","1.1","1.1.1","1.1.2","1.2","1.2.1","1.2.1rc10","1.2.1rc11","1.2.1rc2","1.2.1rc4","1.2.1rc5","1.2.1rc6","1.2.1rc7","1.2.1rc9","1.2.2","1.2.2rc1","1.9.11.dev10","1.9.11.dev11","1.9.11.dev12","1.9.11.dev13","1.9.11.dev14","1.9.11.dev15","1.9.11.dev16","1.9.11.dev17","1.9.11.dev3","1.9.11.dev4","1.9.11.dev6","1.9.11.dev7","1.9.11.dev8","1.9.11.dev9","2.0","2.0.1","2.0.2","2.0.3","2.0a1","2.0rc1","2.0rc2","2.1","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8","2.1.9"]},{"source":"osv","ecosystem":"PyPI","package":"indico","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.2.3"}]}],"versions":["2.2","2.2.1","2.2.2"]}],"references":[{"url":"https://github.com/indico/indico/security/advisories/GHSA-67cx-rhhq-mfhq","tags":["web"]},{"url":"https://github.com/advisories/GHSA-67cx-rhhq-mfhq","tags":["advisory"]},{"url":"https://github.com/indico/indico","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-67cx-rhhq-mfhq","title":"High severity vulnerability that affects indico","description":"## Local file disclosure through LaTeX injection\n\n### Impact\nAn external audit of the Indico codebase has discovered a vulnerability in Indico's LaTeX sanitization code, which could have malicious users to run unsafe LaTeX commands on the server. Such commands allowed for example to read local files (e.g. `indico.conf`).\n\nAs far as we know it is not possible to write files or execute code using this vulnerability.\n\n### Patches\nYou need to update to [Indico 2.2.3](https://github.com/indico/indico/releases/tag/v2.2.3) as soon as possible.\nWe also released [Indico 2.1.10](https://github.com/indico/indico/releases/tag/v2.1.10) in case you cannot update to 2.2 for some reason.\nSee https://docs.getindico.io/en/stable/installation/upgrade/ for instructions on how to update.\n\n### Workarounds\nSetting `XELATEX_PATH = None` in `indico.conf` will result in an error when building a PDF, but without being able to run xelatex, the vulnerability cannot be abused.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open a thread in [our forum](https://talk.getindico.io/)\n* Email us privately at [indico-team@cern.ch](mailto:indico-team@cern.ch)\n\n","status":"published","published":"2019-10-11T18:28:07Z","modified":"2023-01-09T05:02:54Z","cwes":["CWE-77"],"updated_at":"2026-11-02T14:36:04.396827Z"}],"osv":[{"id":"GHSA-67cx-rhhq-mfhq","title":"High severity vulnerability that affects indico","description":"## Local file disclosure through LaTeX injection\n\n### Impact\nAn external audit of the Indico codebase has discovered a vulnerability in Indico's LaTeX sanitization code, which could have malicious users to run unsafe LaTeX commands on the server. Such commands allowed for example to read local files (e.g. `indico.conf`).\n\nAs far as we know it is not possible to write files or execute code using this vulnerability.\n\n### Patches\nYou need to update to [Indico 2.2.3](https://github.com/indico/indico/releases/tag/v2.2.3) as soon as possible.\nWe also released [Indico 2.1.10](https://github.com/indico/indico/releases/tag/v2.1.10) in case you cannot update to 2.2 for some reason.\nSee https://docs.getindico.io/en/stable/installation/upgrade/ for instructions on how to update.\n\n### Workarounds\nSetting `XELATEX_PATH = None` in `indico.conf` will result in an error when building a PDF, but without being able to run xelatex, the vulnerability cannot be abused.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open a thread in [our forum](https://talk.getindico.io/)\n* Email us privately at [indico-team@cern.ch](mailto:indico-team@cern.ch)\n\n","status":"published","published":"2019-10-11T18:28:07Z","modified":"2024-12-02T05:43:40.309364Z","cwes":["CWE-77"],"updated_at":"2026-11-02T15:46:39.266402Z"}]}}