Beware, Developers: BlazeStealer Malware Discovered in Python Packages on PyPI

A new set of malicious Python packages has slithered their way to the Python Package Index PyPI repository with the ultimate aim of stealing sensitive information from compromised developer systems. The packages masquerade as seemingly innocuous obfuscation tools, but harbor a piece of malware...

Rocky Linux 8 : python27:2.7 (RLSA-2021:1761)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:1761 advisory. - http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker control...

12bucks (=0.1.0), 2u-enterprise-data (=10.22.1) +1410 more potentially affected by CVE-2023-46695 via django (>=4.2.0 <=4.2.6)

django PYPI version =4.2.0, =0.7.0, =0.1.6a0, =0.1.0, =1.8.0, =0.1.0a0, =1.0.0, =2.0.0, =2.0.0, =0.0.9, =1.1.0, =0.0.1, =0.11.0 and more Source cves: CVE-2023-46695 Source advisory: OSV:GHSA-QMF9-6JQF-J8FQ...

adyanutils (>=0.4.0 <=0.8.6), apricot-server (>=0.0.6 <=0.1.1) +109 more potentially affected by CVE-2023-46137 via twisted (>=20.3.0 <=23.10.0)

twisted PYPI version =20.3.0, =0.4.0, =0.0.6, =0.2.0, =3.4.1, =1.5.0, =1.5.0, =0.2.0, =0.0.2, =3.9.2, =1.0.0, =0.1.0.dev2, =0.3.4, =1.0.1 and more Source cves: CVE-2023-46137 Source advisory: OSV:GHSA-XC8X-VP79-P3WM...

a2grunnerp (>=0.1.0 <=0.1.8), a4t-sale-discount (=5.0.2) +2126 more potentially affected by CVE-2023-46136 via werkzeug (>=0.10.1 <=2.3.7)

werkzeug PYPI version =0.10.1, =0.1.0, =1.0.2, =0.10.3, =1.8.8, =0.8.44.4, =4.2.0, =0.4.0, =0.9.2, =0.1.0, =0.0.1, =0.0.4 - adminui =1.5.2 and more Source cves: CVE-2023-46136 Source advisory: OSV:PYSEC-2023-221...

aimmo (>=0.57.1 <=1.3.1b671), cfl-common (>=4.3.0 <=5.26.7) +116 more potentially affected by CVE-2023-45809 via wagtail (>=1.0.0 <=4.0.4)

wagtail PYPI version =1.0.0, =0.57.1, =4.3.0, =2.28.0, =0.5.0, =0.3.1, =0.1.29, =0.2.0, =2.0.3, =0.1.1, =0.2.4, =5.22.3, =10.2.9 and more Source cves: CVE-2023-45809 Source advisory: OSV:PYSEC-2023-219...

aaronblaser-sdk (>=1.0.0 <=1.0.1), actoolkit (>=2.6.4 <=2.6.10) +272 more potentially affected by CVE-2023-43804 via urllib3 (>=2.0.0 <=2.0.5)

urllib3 PYPI version =2.0.0, =1.0.0, =2.6.4, =0.0.1, =0.1.1, =0.5.0, =0.1.23, =0.4.3, =0.4.1, =0.0.12, =0.0.14 and more Source cves: CVE-2023-43804 Source advisory: OSV:PYSEC-2023-192...

0lever-utils (>=0.0.2 <=0.0.7), 2keys (=0.5.1) +4801 more potentially affected by CVE-2023-43804 via urllib3 (>=1.10.2 <=1.26.16)

urllib3 PYPI version =1.10.2, =0.0.2, =0.0.2, =0.1.0, =0.1.0, =0.2.0rc1, =1.0.2, =0.3.4, =0.4.6, =0.1.0, =0.5.6, =0.5.6.dev1 - acapy-patched-old =0.5.6 and more Source cves: CVE-2023-43804 Source advisory: OSV:PYSEC-2023-192...

a-cv-imwrite-imread-plus (=0.12.0), aana (>=0.2.1 <=0.2.4) +3175 more potentially affected by CVE-2023-4863 via opencv-python-headless (>=3.4.3.18 <=4.8.0.76)

opencv-python-headless PYPI version =3.4.3.18, =0.2.1, =1.0.0, =0.17.3, =0.0.1.44, =0.0.1, =0.0.1, =0.2.1, =0.2.0, =0.3.0, =0.1.0, =0.1.2 and more Source cves: CVE-2023-4863 Source advisory: OSV:PYSEC-2023-184...

a9s (=0.7.0), algora-sdk (>=1.3.2 <=1.5.39) +76 more potentially affected by CVE-2023-26145 via pydash (>=4.2.1 <=5.1.2)

pydash PYPI version =4.2.1, =1.3.2, =0.1.0, =1.9.0, =0.2.6, =0.1.0, =1.0.1, =0.1.0b1, =0.0.2, =0.0.2, =0.1.0b1, =1.0.1, =2020.7.8, =0.0.20, =0.1.0, =0.3.1 and more Source cves: CVE-2023-26145 Source advisory: OSV:PYSEC-2023-179...

SUSE SLES15 Security Update : grpc, protobuf, python-Deprecated, python-PyGithub, python-aiocontextvars, python-avro, python-bcrypt, python-cryptography, python-cryptography-vectors, python-google-api-core, python-googleapis-common-protos, python-grpcio-gcp, python-humanfriendly, python-jsondiff, python-knack, python-opencensus, python-opencensus-context, python-opencensus-ext-threading, python-opentelemetry-api, python-psutil, python-pytest-asyncio, python-requests, python-websocket-client, python-websockets (SUSE-SU-2023:2783-2)

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2783-2 advisory. - aaugustin websockets version 4 contains a CWE-409: Improper Handling of Highly Compressed Data Data Amplification vulnerability in Servers an...

SUSE-SU-2023:2783-2 Security update for grpc, protobuf, python-Deprecated, python-PyGithub, python-aiocontextvars, python-avro, python-bcrypt, python-cryptography, python-cryptography-vectors, python-google-api-core, python-googleapis-common-protos, python-grpcio-gcp, python-humanfriendly, python-jsondiff, python-knack, python-opencensus, python-opencensus-context, python-opencensus-ext-threading, python-opentelemetry-api, python-psutil, python-pytest-asyncio, python-requests, python-websocket-client, python-websockets

This update for grpc, protobuf, python-Deprecated, python-PyGithub, python-aiocontextvars, python-avro, python-bcrypt, python-cryptography, python-cryptography-vectors, python-google-api-core, python-googleapis-common-protos, python-grpcio-gcp, python-humanfriendly, python-jsondiff, python-knack,...

Malicious code in aliababcloud-tea-openapi (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 644686188e6f43d2dc595074d7644cba060e6a91b8de18713f4b551a76a6c3b7 Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security...

North Korean Hackers Deploy New Malicious Python Packages in PyPI Repository

Three additional rogue Python packages have been discovered in the Package Index PyPI repository as part of an ongoing malicious software supply chain campaign called VMConnect, with signs pointing to the involvement of North Korean state-sponsored threat actors. The findings come from...

agent-actors (=0.1.0), agentverse (>=0.1.5 <=0.1.8.1) +78 more potentially affected by CVE-2023-36281 via langchain (>=0.0.100 <=0.0.168)

langchain PYPI version =0.0.100, =0.1.5, =0.0.1, =0.0.5, =0.2.0, =0.1.1, =0.1.1, =0.0.0, =0.0.1, =0.1.0, =0.2.1, =0.1.0, =0.0.1, =0.0.3, =0.0.7 and more Source cves: CVE-2023-36281 Source advisory: OSV:PYSEC-2023-151...

Malicious code in python-aliyun-sdk-core (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 63f6387d6bfe7ae582be4478cf6a42a8104b44ea50b22489f5217ba2bfb3ce39 Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security...

2vyper (=0.3.0), ape-dasy (=0.1.0) +49 more potentially affected by CVE-2023-39363 via vyper (>=0.1.0b12 <=0.4.3)

vyper PYPI version =0.1.0b12, =0.6.0, =0.5.0a1, =0.7.1, =0.1.0, =0.0.1, =0.0.0, =0.0.0, =0.0.5, =0.1.0, =0.1.0, =0.1.0, =0.6.4 - blackadder =0.1.1 and more Source cves: CVE-2023-39363 Source advisory: OSV:PYSEC-2023-142...

170051277-trab-final-gces (>=0.3.0 <=0.5.0), 2022-2-gces-ifpf (=0.3.0) +2742 more potentially affected by CVE-2023-37920 via certifi (>=2015.4.28 <=2023.5.7)

certifi PYPI version =2015.4.28, =0.3.0, =0.0.2, =0.0.6, =1.0.0, =0.1.0, =0.2.1, =1.0.0, =1.0.2, =0.1.1, =1.0.0, =0.1.0, =0.1.0, =1.0.0 - abuseipdb-wrapper =0.1.7 and more Source cves: CVE-2023-37920 Source advisory: OSV:PYSEC-2023-135...

a2grunnerp (>=0.1.0 <=0.1.8), abuseipdb-wrapper (=0.1.7) +403 more potentially affected by CVE-2022-40896 via pygments (>=1.6.0 <=2.15.0)

pygments PYPI version =1.6.0, =0.1.0, =2.0.0.1, =0.0.1, =1.3.0, =0.3.2, =0.4.0, =1.0.0, =0.4.0, =4.2.0, =4.2.3 and more Source cves: CVE-2022-40896 Source advisory: OSV:PYSEC-2023-117...

aimmo (>=0.4.0b3098 <=0.27.4b5229), battlehack20 (>=1.0.0 <=1.1.0) +6 more potentially affected by CVE-2023-37271 via restrictedpython (>=4.0.0b4 <=5.2.0)

restrictedpython PYPI version =4.0.0b4, =0.4.0b3098, =1.0.0, =1.0.1, =1.1.1, =0.1.0, =0.3.4, =0.0.41, =0.1047.0, =1.7.36 Source cves: CVE-2023-37271 Source advisory: OSV:PYSEC-2023-118...