Home > Vulnerability Database > CVE-2022-21797

Mend.io Vulnerability Database

CVE-2022-21797

Good to know:

Date: September 26, 2022

The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.

Language: Python

Severity Score

7.3

Related Resources (19)

Url: https://github.com/joblib/joblib/commit/6638b9e9711ad1ebbf6dd95aa7cee0dca9897b42

Url: https://github.com/joblib/joblib

Url: https://github.com/joblib/joblib/pull/1352

Url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MJ5XTJS6OKJRRVXWFN5J67K3BYPEOBDF/

Url: https://github.com/joblib/joblib/issues/1128

Url: https://nvd.nist.gov/vuln/detail/CVE-2022-21797

Url: https://security.gentoo.org/glsa/202401-01

Url: https://github.com/pypa/advisory-database/tree/main/vulns/joblib/PYSEC-2022-288.yaml

Url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MJ5XTJS6OKJRRVXWFN5J67K3BYPEOBDF

Url: https://lists.debian.org/debian-lts-announce/2022/11/msg00020.html

Url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BVOMMW37OXZWU2EV5ONAAS462IQEHZOF

Url: https://github.com/joblib/joblib/pull/1321

Url: https://lists.debian.org/debian-lts-announce/2023/03/msg00027.html

Url: https://github.com/joblib/joblib/pull/1327

Url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BVOMMW37OXZWU2EV5ONAAS462IQEHZOF

Url: https://github.com/joblib/joblib/commit/b90f10efeb670a2cc877fb88ebb3f2019189e059

Url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MJ5XTJS6OKJRRVXWFN5J67K3BYPEOBDF

Url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BVOMMW37OXZWU2EV5ONAAS462IQEHZOF/

Url: https://www.mend.io/vulnerability-database/CVE-2022-21797

Severity Score

7.3

Weakness Type (CWE)

Improper Control of Generation of Code ('Code Injection')

CWE-94

Insufficient Information

NVD-CWE-noinfo

Top Fix

Upgrade Version

Upgrade to version joblib - 1.2.0

Learn More

CVSS v3.1

Base Score:	7.3
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	LOW
Integrity (I):	LOW
Availability (A):	LOW

Mend.io Vulnerability Database

We found results for “”

CVE-2022-21797

Good to know:

Date: September 26, 2022

Language: Python

Severity Score

Related Resources (19)

Severity Score

Weakness Type (CWE)

Top Fix

Upgrade Version

CVSS v3.1

Do you need more information?