PYSEC-2022-288

vendorUSosv

view advisory published 2022-09-26Licence: CC-BY-4.0

The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-21797US	critical9.8	2.63% (85th)	—	2022-09-26
The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.

references

External citations — patches, advisories, analysis.

https://github.com/advisories/GHSA-6hrg-qmvc-2xh8ADVISORY
https://github.com/joblib/joblib/commit/b90f10efeb670a2cc877fb88ebb3f2019189e059FIX
https://github.com/joblib/joblib/issues/1128REPORT
https://github.com/joblib/joblib/pull/1321WEB
https://security.snyk.io/vuln/SNYK-PYTHON-JOBLIB-3027033WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan