CVE-2022-21699 Execution with Unnecessary Privileges in ipython
An attacker can execute arbitrary code as another user on the same machine due to improper management of cross-user temporary files in IPython.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-21699?
CVE-2022-21699 is a high-severity vulnerability in Debian Debian Linux, published on 19 Jan 2022. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Affected versions are subject to an arbitrary code execution vulnerability achieved by not properly managing cross user temporary files. This vulnerability allows one user to run code as another on the same machine. All users are advised to upgrade.
Which versions are affected by CVE-2022-21699?
9 open source packages ship an affected version, including ipython. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
ipython PyPI | All versions | 6.0.0rc1, 7.16.3, 7.31.1, 8.0.1 |
ipython PyPI | All versions | 5.11 |
ipython PyPI | All versions | 5.11 |
ipython PyPI | From 6.0.0 | 7.16.3 |
ipython PyPI | From 6.0.0 | 7.16.3 |
ipython PyPI | From 7.17.0 | 7.31.1 |
3 more packages
ipython PyPI | From 7.17.0 | 7.31.1 |
ipython PyPI | From 8.0.0 | 8.0.1 |
ipython PyPI | From 8.0.0 | 8.0.1 |
Linux distribution packages (5)
python-ipython SUSE:Package Hub 15 SP3 | All versions | 7.13.0-bp153.2.6.1 |
python-ipython-test SUSE:Package Hub 15 SP3 | All versions | 7.13.0-bp153.2.6.6 |
python-ipython openSUSE:Leap 15.3 | All versions | 7.13.0-bp153.2.6.1 |
python-ipython-test openSUSE:Leap 15.3 | All versions | 7.13.0-bp153.2.6.6 |
python-ipython openSUSE:Tumbleweed | All versions | 8.31.0-1.1 |
Products include Debian Debian Linux, Fedoraproject Fedora, Ipython Ipython.
How do I fix CVE-2022-21699?
Upgrade ipython to a fixed version for your release line: 6.0.0rc1, 7.16.3, 7.31.1 or 8.0.1.
Is CVE-2022-21699 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-21699 exists.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as AZL-109526, DEBIAN-CVE-2022-21699, DLA-2896-1, DSA-5065-1, GHSA-pq7m-3gw7-gq5x, MGASA-2023-0058 and 6 more.