PT-2022-7152 · Python Packaging Authority +7 · Wheel +7

🗓️ 21 Dec 2022 00:00:00Reported by Positive TechnologiesType

ptsecurity🔗 dbugs.ptsecurity.com👁 1 Views

There is a DoS flaw in Python packaging wheel before 0.38.1 due to attacker input to the wheel CLI via a vulnerable regex.

Reporter	Title	Published	Views	Family All 266
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities affect IBM Robotic Process Automation	31 Aug 202314:44	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in gRPC affect watsonx.data	25 Sep 202419:07	–	ibm
IBM Security Bulletins	Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to unwanted disconnects due to the gRPC package (CVE-2023-33953)	23 Jul 202513:33	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MQ Operator and Queue manager container images are vulnerable to multiple vulnerabilities from systemd, libcap, openssl-libs, libxml2, go-toolset, and prometheus-operator	28 Aug 202308:17	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Ceph is vulnerable to Uncontrolled Resource Consumption in the RHEL UBI (CVE-2022-40898)	5 Aug 202420:20	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM protocols are affected by denial of service.	15 Jul 202515:17	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities have been identified in IBM Db2 shipped with IBM WebSphere Remote Server	14 Dec 202321:06	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Pypa Setuptools, Golang Go, OpenSSH, Minio and Certifi may affect IBM Spectrum Protect Plus Container backup and restore for Kubernetes and OpenShift	26 Mar 202503:37	–	ibm
IBM Security Bulletins	Security Bulletin: gRPC HTTP/2 HPACK Desynchronization Vulnerability Allowing Header Leakage and Privilege Escalation, affects watsonx.data	4 Dec 202508:44	–	ibm
IBM Security Bulletins	Security Bulletin: Python Packaging Authority (PyPA) Wheel is vulnerable to CVE-2022-40898 used in IBM Maximo Application Suite	2 May 202317:53	–	ibm

Source	Link
pyup	www.pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages
cve	www.cve.org/CVERecord
osv	www.osv.dev/vulnerability/USN-5821-3
ubuntu	www.ubuntu.com/security/notices/USN-5821-4
osv	www.osv.dev/vulnerability/SUSE-SU-2023:0089-1
osv	www.osv.dev/vulnerability/USN-5821-4
osv	www.osv.dev/vulnerability/PYSEC-2022-43017
advisories	www.advisories.mageia.org/MGASA-2023-0218.html
bdu	www.bdu.fstec.ru/vul/2023-05360
osv	www.osv.dev/vulnerability/GHSA-qwmp-2cf2-g9g6

20 Jan 2025 00:00Current

6.8Medium risk

Vulners AI Score6.8

CVSS 27.8

CVSS 3.17.5

EPSS0.00184

SSVC