Log in Start free

Vulnerability · Published Sep 26, 2022 · Assigned by snyk

CVE-2022-21797Arbitrary Code Execution

High 7.3

In plain English

A high-severity code injection in joblib. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.6% (higher than 86% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.3High
Exploit odds (30 days)2.6%top 14.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20py3-joblib1.2.0-r0ALPINE-CVE-2022-21797
Alpine:v3.21py3-joblib1.2.0-r0ALPINE-CVE-2022-21797
Alpine:v3.22py3-joblib1.2.0-r0ALPINE-CVE-2022-21797
Alpine:v3.23py3-joblib1.2.0-r0ALPINE-CVE-2022-21797
Alpine:v3.24py3-joblib1.2.0-r0ALPINE-CVE-2022-21797
Debian:12joblib1.2.0-1DEBIAN-CVE-2022-21797
Debian:13joblib1.2.0-1DEBIAN-CVE-2022-21797
Debian:14joblib1.2.0-1DEBIAN-CVE-2022-21797
PyPIjoblib1.2.0GHSA-6hrg-qmvc-2xh8
PyPIjoblib1.2.0PYSEC-2022-288
Ubuntu:22.04:LTSjoblibno fix listedUBUNTU-CVE-2022-21797

Affected products (as reported)

VendorProductVersions
n/a joblib 0 – before unspecifiedunspecified – before 1.2.0

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P

References