py-rate (>=0.1.2, <=0.2.0) potentially affected by CVE-2024-21542 via luigi (1.3.0)

luigi PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on luigi and may be impacted: - py-rate =0.1.2, =0.2.0 Source cves: CVE-2024-21542 Source advisory: OSV:GHSA-8QCH-VJ6M-2694...

py-rate (>=0.1.2, <=0.2.0) potentially affected by CVE-2024-21542 via luigi (1.3.0)

luigi PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on luigi and may be impacted: - py-rate =0.1.2, =0.2.0 Source cves: CVE-2024-21542 Source advisory: OSV:PYSEC-2024-159...

aws-service-catalog-factory (>=0.4.0, <=0.22.1), aws-service-catalog-puppet (>=0.25.0, <=0.31.0) potentially affected by CVE-2024-21542 via luigi (2.8.7)

luigi PYPI version 2.8.7 is affected by a known vulnerability. The following packages have a transitive dependency on luigi and may be impacted: - aws-service-catalog-factory =0.4.0, =0.25.0, =0.31.0 Source cves: CVE-2024-21542 Source advisory: OSV:PYSEC-2024-159...

aws-service-catalog-puppet (>=0.42.0, <=0.95.0) potentially affected by CVE-2024-21542 via luigi (2.8.9)

luigi PYPI version 2.8.9 is affected by a known vulnerability. The following packages have a transitive dependency on luigi and may be impacted: - aws-service-catalog-puppet =0.42.0, =0.95.0 Source cves: CVE-2024-21542 Source advisory: OSV:PYSEC-2024-159...

CVE-2024-21542

creationtimestamp| type| source ---|---|--- 2024-12-10 05:04:55+00:00| seen| https://infosec.exchange/users/cve/statuses/113626781732575380 2024-12-10 07:26:25+00:00| seen| https://t.me/cvedetector/12479...

CVE-2024-21542

CVE-2024-21542 affects luigi before 3.6.0, vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) caused by improper destination file path validation in the _extract_packages_archive function. A malicious zip can traverse paths to overwrite arbitrary files outside the target directo...

CVE-2024-21542

Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip due to improper destination file path validation in the extractpackagesarchive function...

aws-service-catalog-factory (>=0.4.0, <=0.102.1), aws-service-catalog-puppet (>=0.1.0, <=0.253.0) +73 more potentially affected by CVE-2024-21542 via luigi (>=1.3.0, <=3.5.2)

luigi PYPI version =1.3.0, =0.4.0, =0.1.0, =0.3.1, =0.4.0, =0.0.8, =0.40.0, =1.0.1, =0.4.0, =1.0.0a20, =1.2.1, =0.5.0, =0.0.7, =0.1.0, =0.1.0, =0.11.20 and more Source cves: CVE-2024-21542 Source advisory: MEND:CVE-2024-21542...

CVE-2024-21542

Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip due to improper destination file path validation in the extractpackagesarchive function...