CVE-2022-34981 Supply chain in n/a
A backdoor in the PyCrowdTangle package allows attackers to execute arbitrary code on systems installing the malicious version.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-34981?
CVE-2022-34981 is a critical vulnerability in n/a, published on 22 Jul 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The PyCrowdTangle package in PyPI before v0.0.1 included a code execution backdoor inserted by a third party.
Which versions are affected by CVE-2022-34981?
1 open source package ship an affected version, including pycrowdtangle. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pycrowdtangle PyPI | From 0.0.1 | 0.0.3 |
Products include Pycrowdtangle Project Pycrowdtangle.
How do I fix CVE-2022-34981?
Upgrade pycrowdtangle to 0.0.3 or later.
Is CVE-2022-34981 being exploited?
There is no known exploitation of CVE-2022-34981 in the wild and no public exploit code.
Sources
Also known as GHSA-hwrh-8hxh-8cqh, PYSEC-2022-242.