Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Critical severity, with a CVSS score of 9.8, published 21 July 2023.

Is there a fix for This vulnerability?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is This vulnerability attacked?

It is attacked over the network or with local access, in a software library.

Check whether you run openbabel (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Open Babel out-of-bounds write in CSR format PadString

Severity: critical · CVSS 9.8 · Published 2023-07-21

Open Babel, a widely used library for converting chemical data formats, contains a security flaw in how it handles molecule titles when saving files in the CSR format. An attacker could provide a specially crafted chemical file that, when processed by the software, allows for unauthorized code execution. This could lead to a complete system takeover, especially in web-based chemical viewers or converters that use this library to process user-uploaded data.

Technologies: openbabel (PyPI). Vendors: PyPI.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Critical severity, with a CVSS score of 9.8, published 21 July 2023.
Which products and versions are affected?: openbabel (PyPI) < 3.2.0.
Is there a fix for This vulnerability?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is This vulnerability attacked?: It is attacked over the network or with local access, in a software library.
Am I affected?: Check whether you run openbabel (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds (OOB) write vulnerability exists in Open Babel versions prior to 3.2.0 within the CSR format's title processing logic. The flaw is located in the `CSRFormat::PadString` function in `formats/CSRformat.cpp`, where a `strncpy` operation uses the length of the input title as the copy limit rather than the size of the destination buffer (fixed at 80 bytes). By providing a molecule with a title longer than 80 characters, an attacker can trigger a heap-based buffer overflow. This can be exploited via the `obabel` command-line tool or any application using the library to convert files to the CSR format, potentially leading to arbitrary code execution. The vulnerability is reachable over the network if the library is used in backend web services for chemical format conversion.

Affected products

Open Babel Open Babel 3.1.1, master commit 530dbfa3, all versions before 3.2.0

Timeline

2023-07-21: advisory: Initial advisory published by Talos and GitHub
2026-07-01: other: Advisory GHSA-jmf7-79p7-qchq withdrawn as a duplicate of GHSA-p594-7xw4-g76p

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.