CVE-2022-21797 Arbitrary Code Execution
Attackers can execute arbitrary code via the pre_dispatch flag in the Parallel class due to unsafe eval usage in the joblib library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-21797?
CVE-2022-21797 is a high-severity code injection vulnerability in Debian Debian Linux, published on 26 Sep 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.
Weakness: CWE-94
Which versions are affected by CVE-2022-21797?
3 open source packages ship an affected version, including joblib. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
joblib PyPI | All versions | 1.2.0 |
joblib PyPI | All versions | 1.2.0 |
joblib PyPI | All versions | 1.2.0 |
Linux distribution packages (3)
python-joblib SUSE:Package Hub 15 SP3 | All versions | 0.16.0-bp153.2.3.1 |
python-joblib openSUSE:Leap 15.3 | All versions | 0.16.0-bp153.2.3.1 |
python-joblib openSUSE:Tumbleweed | All versions | 1.4.2-2.1 |
Products include Debian Debian Linux, Fedoraproject Fedora, Joblib Project Joblib.
How do I fix CVE-2022-21797?
Upgrade joblib to 1.2.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2022-21797 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-21797 exists.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2022-21797, DLA-3193-2, GHSA-6hrg-qmvc-2xh8, MGASA-2022-0375, MINI-jhmp-9jf2-v4gr, OESA-2022-1990 and 5 more.