CVE-2022-21797

2022-09-2605:15:10

CWE-94

[email protected]

web.nvd.nist.gov

package joblib

arbitrary code execution

parallel class

eval statement

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.005

Percentile

76.7%

JSON

The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.

Affected configurations

Nvd

Node

joblib_projectjoblibRange<1.1.1python

Node

fedoraprojectfedoraMatch36

fedoraprojectfedoraMatch37

Node

debiandebian_linuxMatch10.0

VendorProductVersionCPE
joblib_projectjoblib*cpe:2.3:a:joblib_project:joblib:*:*:*:*:*:python:*:*
fedoraprojectfedora36cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
fedoraprojectfedora37cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
debiandebian_linux10.0cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
joblib_project	joblib	*	cpe:2.3:a:joblib_project:joblib::::::python::*
fedoraproject	fedora	36	cpe:2.3:o:fedoraproject:fedora:36:::::::*
fedoraproject	fedora	37	cpe:2.3:o:fedoraproject:fedora:37:::::::*
debian	debian_linux	10.0	cpe:2.3:o:debian:debian_linux:10.0:::::::*