CVE-2022-21699

Опубликовано: 19 янв. 2022

Источник: nvd

CVSS3: 8.2

CVSS3: 8.8

CVSS2: 4.6

EPSS Низкий

Описание

IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Affected versions are subject to an arbitrary code execution vulnerability achieved by not properly managing cross user temporary files. This vulnerability allows one user to run code as another on the same machine. All users are advised to upgrade.

Ссылки

https://github.com/ipython/ipython/commit/46a51ed69cdf41b4333943d9ceeb945c4ede5668
Patch
Third Party Advisory
https://github.com/ipython/ipython/security/advisories/GHSA-pq7m-3gw7-gq5x
Exploit
Third Party Advisory
https://ipython.readthedocs.io/en/stable/whatsnew/version8.html#ipython-8-0-1-cve-2022-21699
Release Notes
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/01/msg00021.html
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CRQRTWHYXMLDJ572VGVUZMUPEOTPM3KB/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DZ7LVZBB4D7KVSFNEQUBEHFO3JW6D2ZK/
https://github.com/ipython/ipython/commit/46a51ed69cdf41b4333943d9ceeb945c4ede5668
Patch
Third Party Advisory
https://github.com/ipython/ipython/security/advisories/GHSA-pq7m-3gw7-gq5x
Exploit
Third Party Advisory
https://ipython.readthedocs.io/en/stable/whatsnew/version8.html#ipython-8-0-1-cve-2022-21699
Release Notes
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/01/msg00021.html
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CRQRTWHYXMLDJ572VGVUZMUPEOTPM3KB/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DZ7LVZBB4D7KVSFNEQUBEHFO3JW6D2ZK/

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ipython:ipython:*:*:*:*:*:*:*:*

Версия до 5.10.0 (включая)

cpe:2.3:a:ipython:ipython:*:*:*:*:*:*:*:*

Версия от 6.0.0 (включая) до 7.16.3 (исключая)

cpe:2.3:a:ipython:ipython:*:*:*:*:*:*:*:*

Версия от 7.17.0 (включая) до 7.31.1 (исключая)

cpe:2.3:a:ipython:ipython:*:*:*:*:*:*:*:*

Версия от 8.0.0 (включая) до 8.0.1 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*

EPSS

Процентиль: 52%

0.00652

Низкий

8.2 High

CVSS3

8.8 High

CVSS3

4.6 Medium

CVSS2

Дефекты

CWE-250

CWE-269

Связанные уязвимости

CVE-2022-21699

CVSS3: 8.8

ubuntu

почти 5 лет назад

CVE-2022-21699

CVSS3: 8.2

msrc

9 месяцев назад

Execution with Unnecessary Privileges in ipython

CVE-2022-21699

CVSS3: 8.8

debian

почти 5 лет назад

IPython (Interactive Python) is a command shell for interactive comput ...

openSUSE-SU-2022:10043-1

suse-cvrf

больше 4 лет назад

Security update for python-ipython

GHSA-pq7m-3gw7-gq5x

CVSS3: 8.2

github

почти 5 лет назад

Execution with Unnecessary Privileges in ipython

EPSS

Процентиль: 52%

0.00652

Низкий

8.2 High

CVSS3

8.8 High

CVSS3

4.6 Medium

CVSS2

Дефекты

CWE-250

CWE-269