Описание
The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| joblib | fixed | 1.2.0-1 | package | |
| joblib | fixed | 0.17.0-4+deb11u1 | bullseye | package |
Примечания
https://github.com/joblib/joblib/issues/1128
https://github.com/joblib/joblib/pull/1321
Better fix: https://github.com/joblib/joblib/pull/1327
Fixed by: https://github.com/joblib/joblib/commit/54f4d21f098591c77b48c9acfffaa4cf0a45282b (1.2.0)
https://security.snyk.io/vuln/SNYK-PYTHON-JOBLIB-3027033
EPSS
Связанные уязвимости
The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.
The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.
ALT-PU-2022-2646: package `python3-module-joblib` update to version 1.2.0-alt1
EPSS