Описание
Poetry is a dependency manager for Python. From version 1.4.0 to before version 2.3.3, a crafted wheel can contain ../ paths that Poetry writes to disk without containment checks, allowing arbitrary file write with the privileges of the Poetry process. It is reachable from untrusted package artifacts during normal install flows. (Normally, installing a malicious wheel is not sufficient for execution of malicious code. Malicious code will only be executed after installation if the malicious package is imported or invoked by the user.). This issue has been patched in version 2.3.3.
A flaw was found in Poetry, a dependency manager for Python. A remote attacker can exploit this vulnerability by providing a specially crafted package (wheel) that contains directory traversal sequences. When Poetry installs this malicious package, it writes files to arbitrary locations on the system with the privileges of the Poetry process, leading to unauthorized file modification or creation.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat OpenShift Container Platform 4 | python-poetry-core | Not affected | ||
| Red Hat Satellite 6 | python3.12-poetry_core | Not affected | ||
| Red Hat Satellite 6 | python3.12-poetry_plugin_export | Not affected | ||
| Red Hat Satellite 6 | python-poetry_core | Not affected | ||
| Red Hat Satellite 6 | python-poetry_plugin_export | Not affected |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
6.5 Medium
CVSS3
Связанные уязвимости
Poetry is a dependency manager for Python. From version 1.4.0 to before version 2.3.3, a crafted wheel can contain ../ paths that Poetry writes to disk without containment checks, allowing arbitrary file write with the privileges of the Poetry process. It is reachable from untrusted package artifacts during normal install flows. (Normally, installing a malicious wheel is not sufficient for execution of malicious code. Malicious code will only be executed after installation if the malicious package is imported or invoked by the user.). This issue has been patched in version 2.3.3.
Poetry is a dependency manager for Python. From version 1.4.0 to before version 2.3.3, a crafted wheel can contain ../ paths that Poetry writes to disk without containment checks, allowing arbitrary file write with the privileges of the Poetry process. It is reachable from untrusted package artifacts during normal install flows. (Normally, installing a malicious wheel is not sufficient for execution of malicious code. Malicious code will only be executed after installation if the malicious package is imported or invoked by the user.). This issue has been patched in version 2.3.3.
Poetry Has Wheel Path Traversal Which Can Lead to Arbitrary File Write
Poetry is a dependency manager for Python. From version 1.4.0 to befor ...
Poetry Has Wheel Path Traversal Which Can Lead to Arbitrary File Write
EPSS
6.5 Medium
CVSS3