9.8

CVE-2022-21797

Exploit

Arbitrary Code Execution

The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Joblib Project ≫ Joblib SwPlatform python Version < 1.1.1
Fedoraproject ≫ Fedora Version 36
Fedoraproject ≫ Fedora Version 37
Debian ≫ Debian Linux Version 10.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.09% 0.798
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Snyk 7.3 3.9 3.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

https://github.com/joblib/joblib/commit/b90f10efeb670a2cc877fb88ebb3f2019189e059
Patch
Third Party Advisory
https://github.com/joblib/joblib/issues/1128
Third Party Advisory
Exploit
Issue Tracking
https://github.com/joblib/joblib/pull/1321
Patch
Third Party Advisory
Issue Tracking
https://lists.debian.org/debian-lts-announce/2022/11/msg00020.html
Third Party Advisory
Mailing List
https://lists.debian.org/debian-lts-announce/2023/03/msg00027.html
Third Party Advisory
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BVOMMW37OXZWU2EV5ONAAS462IQEHZOF/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MJ5XTJS6OKJRRVXWFN5J67K3BYPEOBDF/
https://security.gentoo.org/glsa/202401-01
https://security.snyk.io/vuln/SNYK-PYTHON-JOBLIB-3027033
Patch
Third Party Advisory
Exploit
Issue Tracking