Lucene search

GoogleOSV:PYSEC-2022-43029

HistoryOct 11, 2022 - 10:15 p.m.

PYSEC-2022-43029

2022-10-1122:15:00

Google

osv.dev

pysec-2022-43029

code execution

backdoor

pypi

democritus-urls

python package

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.005 Low

EPSS

Percentile

75.4%

JSON

The d8s-pdfs package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-urls package. The affected version is 0.1.0.

CPENameOperatorVersion
d8s-pdfseq0.2.0
d8s-pdfseq0.5.0
d8s-pdfseq0.4.1
d8s-pdfseq0.4.2
d8s-pdfseq0.3.0
d8s-pdfseq0.1.0
d8s-pdfseq0.6.0
d8s-pdfseq0.4.0

Name	Operator	Version
d8s-pdfs	eq	0.2.0
d8s-pdfs	eq	0.5.0
d8s-pdfs	eq	0.4.1
d8s-pdfs	eq	0.4.2
d8s-pdfs	eq	0.3.0
d8s-pdfs	eq	0.1.0
d8s-pdfs	eq	0.6.0
d8s-pdfs	eq	0.4.0

References

github.com/democritus-project/d8s-pdfs/issues/7

pypi.org/project/d8s-pdfs/

pypi.org/project/democritus-urls/

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.005 Low

EPSS

Percentile

75.4%

JSON

Related for OSV:PYSEC-2022-43029