Описание
In Autoswitch Python Virtualenv before version 0.16.0, a user who enters a directory with a malicious .venv file could run arbitrary code without any user interaction. This is fixed in version: 1.16.0
Ссылки
- PatchThird Party Advisory
- ExploitThird Party Advisory
- Third Party Advisory
- https://github.com/MichaelAquilina/zsh-autoswitch-virtualenv/security/advisories/GHSA-h8wm-cqq6-957qThird Party Advisory
- PatchThird Party Advisory
- ExploitThird Party Advisory
- Third Party Advisory
- https://github.com/MichaelAquilina/zsh-autoswitch-virtualenv/security/advisories/GHSA-h8wm-cqq6-957qThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 1.16.0 (исключая)
cpe:2.3:a:autoswitch_python_virtualenv_project:autoswitch_python_virtualenv:*:*:*:*:*:*:*:*
EPSS
Процентиль: 49%
0.00264
Низкий
7.9 High
CVSS3
7.8 High
CVSS3
4.6 Medium
CVSS2
Дефекты
CWE-77
CWE-22
EPSS
Процентиль: 49%
0.00264
Низкий
7.9 High
CVSS3
7.8 High
CVSS3
4.6 Medium
CVSS2
Дефекты
CWE-77
CWE-22