Описание
The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.
Ссылки
- PatchThird Party Advisory
- ExploitIssue TrackingThird Party Advisory
- Issue TrackingPatchThird Party Advisory
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- ExploitIssue TrackingPatchThird Party Advisory
- PatchThird Party Advisory
- ExploitIssue TrackingThird Party Advisory
- Issue TrackingPatchThird Party Advisory
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- ExploitIssue TrackingPatchThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 1.1.1 (исключая)
cpe:2.3:a:joblib_project:joblib:*:*:*:*:*:python:*:*
Конфигурация 2
Одно из
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
Конфигурация 3
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
EPSS
Процентиль: 86%
0.02627
Низкий
7.3 High
CVSS3
9.8 Critical
CVSS3
Дефекты
NVD-CWE-noinfo
CWE-94
Связанные уязвимости
CVSS3: 9.8
ubuntu
около 4 лет назад
The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.
CVSS3: 9.8
debian
около 4 лет назад
The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary ...
CVSS3: 9.8
altlinux
около 4 лет назад
ALT-PU-2022-2646: package `python3-module-joblib` update to version 1.2.0-alt1
EPSS
Процентиль: 86%
0.02627
Низкий
7.3 High
CVSS3
9.8 Critical
CVSS3
Дефекты
NVD-CWE-noinfo
CWE-94