EUVD-2022-0373

Malicious code in bioql PyPI...

CVE-2022-38883

The d8s-math for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0...

d8s-math (0.6.0), d8s-strings (>=0.4.0, <=0.5.0) +3 more potentially affected by CVE-2022-42039 via d8s-lists (0.8.0)

d8s-lists PYPI version 0.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on d8s-lists and may be impacted: - d8s-math 0.6.0 - d8s-strings =0.4.0, =6.0.0, =4.6.4, =4.7.0 Source cves: CVE-2022-42039 Source advisory: OSV:PYSEC-2022-43027...

Remote Code Execution (RCE)

d8s-math is vulnerable to remote code execution. The vulnerability exists because the library does not properly handle the package upload mechanism, allowing an attacker to inject and execute malicious packages...

CVE-2022-38883

The d8s-math for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0...

PYSEC-2022-43079

The d8s-math for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0...

PYSEC-2022-43079

The d8s-math for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0...

PYSEC-2022-43121

The d8s-math for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0...

CVE-2022-38883

The d8s-math for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0...

CVE-2022-38883

CVE-2022-38883 concerns the Python package d8s-math on PyPI, with the democritus-strings backdoor in version 0.1.0. The vulnerability, as described by multiple sources (NVD/Red Hat/OSV/Veracode/PYSEC advisories), enables potential remote code execution via the package download/upload mechanism, w...

CVE-2022-38883

The d8s-math for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0...

CVE-2022-38883: Unrestricted Upload of File with Dangerous Type

The d8s-math for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0...

PT-2022-24608 · Unknown +1 · Democritus-Strings +1

Name of the Vulnerable Software and Affected Versions: d8s-math version 0.1.0 Description: The d8s-math for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. Recommendations: For version 0.1.0,...

PT-2022-37384 · Pypi · Democritus-Strings +1

Name of the Vulnerable Software and Affected Versions: d8s-math version 0.1.0 Description: The issue concerns a potential code-execution backdoor inserted by a third party into the d8s-math package for Python, distributed on PyPI. The backdoor is identified as the democritus-strings package...

Democritus Project code-related vulnerabilities

Democritus Project is a collection of simple, effective, modular, fully tested and well-documented features from Democritus, Inc. A security vulnerability exists in Democritus Project d8s-math version 0.1.0, which stems from the presence of a potential code execution backdoor inserted by a third...