Malicious code in yelp-cgeom1 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f1d368f32894c442f86028103800df96e8818dd226ac82b14b5cec80a267a202 The OpenSSF Package Analysis project identified 'yelp-cgeom1' @ 0.1 pypi as malicious. It is considered malicious because: - The package...

Malicious code in discomusic (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d5ae86bb92ecda0b9d67bf6bcb933e00f57e91de9916d1b3a3ad5a68993c0778 The OpenSSF Package Analysis project identified 'discomusic' @ 0.0.3 pypi as malicious. It is considered malicious because: - The package...

27 Malicious PyPI Packages with Thousands of Downloads Found Targeting IT Experts

An unknown threat actor has been observed publishing typosquat packages to the Python Package Index PyPI repository for nearly six months with an aim to deliver malware capable of gaining persistence, stealing sensitive data, and accessing cryptocurrency wallets for financial gain. The 27 package...

python: urllib.parse url blocklisting bypass

A flaw was found in the Python package. An issue in the urllib.parse component could allow attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.This may lead to compromised Integrity...

Moderate: Red Hat Security Advisory: python-pip security update

An update for python-pip is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

Moderate: Red Hat Security Advisory: python3.11-pip security update

An update for python3.11-pip is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

Moderate: python3.11-pip security update

pip is a package management system used to install and manage software packages written in Python. Many packages can be found in the Python Package Index PyPI. pip is a recursive acronym that can stand for either "Pip Installs Packages" or "Pip Installs Python". Security Fixes: python: tarfile...

AZL-60006 CVE-2023-5752 affecting package python3 for versions less than 3.9.19-14

When installing a package from a Mercurial VCS URL ie "pip install hg+..." with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call ie "--config". Controlling the Mercurial configuration can modify how and which...

Pip Command Injection Vulnerability

Pip is a set of tools for installing and managing Python packages. A security vulnerability exists in pip versions prior to v23.3, which stems from the presence of an injected arbitrary configuration option call...

SUSE CVE-2023-45805

pdm is a Python package and dependency manager supporting the latest PEP standards. It's possible to craft a malicious pdm.lock file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. A project f...

Malicious code in fbdebug (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2edf3045263e059e2b1599655b25cc167abecc4d1e77e5e7e8d62998b0fd9e18 The OpenSSF Package Analysis project identified 'fbdebug' @ 0.1 pypi as malicious. It is considered malicious because: - The package communicate...

GHSA-J44V-MMF2-XVM9 PDM Trojan Lockfile

Summary It's possible to craft a malicious pdm.lock file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. Details Project foo can be targeted by creating the project foo-2 and uploading the fil...

UBUNTU-CVE-2023-45805

pdm is a Python package and dependency manager supporting the latest PEP standards. It's possible to craft a malicious pdm.lock file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. A project f...

CVE-2023-45805 Trojan Lockfilein pdm

pdm is a Python package and dependency manager supporting the latest PEP standards. It's possible to craft a malicious pdm.lock file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. A project f...

CVE-2023-45805

CVE-2023-45805 affects the Python tool PDM (dependency manager). A crafted pawns-style lockfile in which a project like foo is targeted with foo-2 and a file foo-2-2.tar.gz can mislead PyPI and PDM into installing a different project than what appears in pyproject.toml, potentially allowing arbit...

CVE-2023-45805 Trojan Lockfilein pdm

pdm is a Python package and dependency manager supporting the latest PEP standards. It's possible to craft a malicious pdm.lock file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. A project f...

CVE-2023-45805

pdm is a Python package and dependency manager supporting the latest PEP standards. It's possible to craft a malicious pdm.lock file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. A project f...

pdm security breach

pdm is a Python package management tool for the PDM project. A security vulnerability exists in versions of pdm prior to 0.11.2, which stems from the ability to craft a malicious pdm.lock file that allows an insider or malicious open source project to appear to rely on a trusted PyPI project, but...

PT-2023-29697

Name of the Vulnerable Software and Affected Versions pdm versions prior to 2.9.4 Description It's possible to craft a malicious pdm.lock file that could allow an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. A...

AZL-35785 CVE-2023-45803 affecting package python-pip for versions less than 24.2-1

urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body like POST to GET as is required by HT...