joblib vulnerable to arbitrary code execution
The package joblib from 0 and before 1.2.0 is vulnerable to Arbitrary Code Execution via the `pre_dispatch` flag in `Parallel()` class due to the `eval()` statement.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-21797US | critical9.8 | — | ||
The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement. | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/joblib/joblibPACKAGE
- https://github.com/joblib/joblib/commit/6638b9e9711ad1ebbf6dd95aa7cee0dca9897b42WEB
- https://github.com/joblib/joblib/commit/b90f10efeb670a2cc877fb88ebb3f2019189e059WEB
- https://github.com/joblib/joblib/issues/1128WEB
- https://github.com/joblib/joblib/pull/1321WEB
- https://github.com/joblib/joblib/pull/1327WEB
- https://github.com/joblib/joblib/pull/1352WEB
- https://github.com/pypa/advisory-database/tree/main/vulns/joblib/PYSEC-2022-288.yamlWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan