EUVD-2024-0098

Malicious code in bioql PyPI...

aws-service-catalog-factory (>=0.4.0 <=0.102.1), aws-service-catalog-puppet (>=0.1.0 <=0.253.0) +71 more potentially affected by CVE-2024-21542 via luigi (>=1.3.0 <=3.5.2)

luigi PYPI version =1.3.0, =0.4.0, =0.1.0, =0.3.1, =0.4.0, =0.0.8, =0.40.0, =1.0.1, =0.4.0, =1.0.0a20, =0.5.0, =0.0.7, =0.1.0, =0.1.0, =0.2.3, =0.10.20 and more Source cves: CVE-2024-21542 Source advisory: OSV:GHSA-8QCH-VJ6M-2694...

CVE-2024-21542

Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip due to improper destination file path validation in the extractpackagesarchive function...

CVE-2024-21542

Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip due to improper destination file path validation in the extractpackagesarchive function...

PYSEC-2024-159

Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip due to improper destination file path validation in the extractpackagesarchive function...

aws-service-catalog-factory (>=0.4.0 <=0.102.1), aws-service-catalog-puppet (>=0.1.0 <=0.253.0) +71 more potentially affected by CVE-2024-21542 via luigi (>=1.3.0 <=3.5.2)

luigi PYPI version =1.3.0, =0.4.0, =0.1.0, =0.3.1, =0.4.0, =0.0.8, =0.40.0, =1.0.1, =0.4.0, =1.0.0a20, =0.5.0, =0.0.7, =0.1.0, =0.1.0, =0.2.3, =0.10.20 and more Source cves: CVE-2024-21542 Source advisory: OSV:PYSEC-2024-159...

CVE-2024-21542

Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip due to improper destination file path validation in the extractpackagesarchive function...

aws-service-catalog-factory (>=0.102.0 <=0.102.1), aws-service-catalog-puppet (>=0.96.0 <=0.253.0) +68 more potentially affected by CVE-2024-21542 via luigi (>=3.0.0b2 <=3.5.2)

luigi PYPI version =3.0.0b2, =0.102.0, =0.96.0, =0.4.0, =0.0.8, =0.40.0, =1.0.1, =0.4.0, =1.0.0a20, =0.5.0, =0.0.7, =0.1.0, =0.1.0, =0.2.3, =0.1.0, =0.1.12, =0.1.15 and more Source cves: CVE-2024-21542 Source advisory: SNYK:PYTHON-LUIGI-7830489...

b2luigi (>=0.3.1 <=0.5.0), py-rate (>=0.1.2 <=0.2.0) potentially affected by CVE-2018-1000843 via luigi (>=1.3.0 <=2.7.8)

luigi PYPI version =1.3.0, =0.3.1, =0.1.2, =0.2.0 Source cves: CVE-2018-1000843 Source advisory: OSV:GHSA-P69G-F978-XXV9...

PYSEC-2018-11

Luigi version prior to version 2.8.0; after commit 53b52e12745075a8acc016d33945d9d6a7a6aaeb; after GitHub PR spotify/luigi/pull/1870 contains a Cross ite Request Forgery CSRF vulnerability in API endpoint: /api/ that can result in Task metadata such as task name, id, parameter, etc. will be leake...

b2luigi (>=0.3.1 <=0.5.0), py-rate (>=0.1.2 <=0.2.0) potentially affected by CVE-2018-1000843 via luigi (>=1.3.0 <=2.7.8)

luigi PYPI version =1.3.0, =0.3.1, =0.1.2, =0.2.0 Source cves: CVE-2018-1000843 Source advisory: OSV:PYSEC-2018-11...