joblib vulnerable to arbitrary code execution
The package joblib from 0 and before 1.2.0 is vulnerable to Arbitrary Code Execution via the `pre_dispatch` flag in `Parallel()` class due to the `eval()` statement.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-21797US | critical9.8 | — | ||
The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement. | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/joblib/joblibPACKAGE
- https://github.com/joblib/joblib/commit/6638b9e9711ad1ebbf6dd95aa7cee0dca9897b42WEB
- https://github.com/joblib/joblib/commit/b90f10efeb670a2cc877fb88ebb3f2019189e059WEB
- https://github.com/joblib/joblib/issues/1128WEB
- https://github.com/joblib/joblib/pull/1321WEB
- https://github.com/joblib/joblib/pull/1327WEB
- https://github.com/joblib/joblib/pull/1352WEB
- https://github.com/pypa/advisory-database/tree/main/vulns/joblib/PYSEC-2022-288.yamlWEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan