Vulnerability · Published Jul 28, 2022 · Assigned by mitre
CVE-2022-34558
Critical 9.8
In plain English
A critical-severity security flaw in the global-workqueue package (PyPI). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)1.3%top 29.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
WMAgent v1.3.3rc2 and 1.3.3rc1, reqmgr 2 1.4.1rc5 and 1.4.0rc2, reqmon 1.4.1rc5, and global-workqueue 1.4.1rc5 allows attackers to execute arbitrary code via a crafted dbs-client package.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | global-workqueue | 2.0.4 | PYSEC-2022-43136 |
| PyPI | global-workqueue | 2.0.4 | GHSA-4vq7-8699-4xgc |
| PyPI | reqmgr2 | 2.0.4 | PYSEC-2026-523 |
| PyPI | reqmgr2 | 2.0.4 | GHSA-4vq7-8699-4xgc |
| PyPI | reqmon | 2.0.4 | GHSA-4vq7-8699-4xgc |
| PyPI | reqmon | 2.0.4 | PYSEC-2022-43163 |
| PyPI | wmagent | 2.0.4 | PYSEC-2022-43174 |
| PyPI | wmagent | 2.0.4 | GHSA-4vq7-8699-4xgc |
Affected products (as reported)
References
- https://github.com/dmwm/WMCore/issues/11188 x_refsource_MISC