CVE-2022-34558 WMAgent arbitrary code execution via a crafted dbs-client package
Attackers can execute arbitrary code in WMAgent and related tools by supplying a malicious dbs-client package.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-34558?
CVE-2022-34558 is a critical code injection vulnerability in n/a, published on 28 Jul 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
WMAgent v1.3.3rc2 and 1.3.3rc1, reqmgr 2 1.4.1rc5 and 1.4.0rc2, reqmon 1.4.1rc5, and global-workqueue 1.4.1rc5 allows attackers to execute arbitrary code via a crafted dbs-client package.
Which versions are affected by CVE-2022-34558?
12 open source packages ship an affected version, including global-workqueue, reqmgr2 and reqmon. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
global-workqueue PyPI | From 1.4.1rc5 | 2.0.4 |
global-workqueue PyPI | From 1.4.1rc5 | 2.0.4 |
global-workqueue PyPI | From 1.4.1rc5 | 2.0.4 |
reqmgr2 PyPI | From 1.4.0rc2 | 2.0.4 |
reqmgr2 PyPI | From 1.4.0rc2 | 2.0.4 |
reqmgr2 PyPI | From 1.4.0rc2 | 2.0.4 |
6 more packages
reqmon PyPI | From 1.4.1rc5 | 2.0.4 |
reqmon PyPI | From 1.4.1rc5 | 2.0.4 |
reqmon PyPI | From 1.4.1rc5 | 2.0.4 |
wmagent PyPI | From 1.3.3rc1 | 2.0.4 |
wmagent PyPI | From 1.3.3rc1 | 2.0.4 |
wmagent PyPI | From 1.3.3rc1 | 2.0.4 |
Products include Global-Workqueue Project Global-Workqueue, Reqmgr2 Project Reqmgr2, Reqmon Project Reqmon, Wmagent Project Wmagent.
How do I fix CVE-2022-34558?
Upgrade global-workqueue to 2.0.4 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2022-34558 being exploited?
There is no known exploitation of CVE-2022-34558 in the wild and no public exploit code.
Sources
Also known as GHSA-4vq7-8699-4xgc, PYSEC-2022-43136, PYSEC-2022-43163, PYSEC-2022-43174, PYSEC-2026-523.