CVE-2022-40432 - The d8s-strings for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party

Back Back to CVE browser

CRITICAL

The d8s-strings for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party

Published Sep 19, 2022

9.8

CRITICAL

CVSS 3.1

EPSS 1.66%

Description

The d8s-strings for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hypothesis package. The affected version is 0.1.0.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-434

Unrestricted Upload of File

References (3)

https://github.com/democritus-project/d8s-strings/issues/21
x_refsource_MISCExploitIssue TrackingThird Party Advisory
https://pypi.org/project/d8s-strings/
x_refsource_MISCProduct
https://pypi.org/project/democritus-hypothesis/
x_refsource_MISCProduct

Link	Providers	Tags
https://github.com/democritus-project/d8s-strings/issues/21		x_refsource_MISCExploitIssue TrackingThird Party Advisory
https://pypi.org/project/d8s-strings/		x_refsource_MISCProduct
https://pypi.org/project/democritus-hypothesis/		x_refsource_MISCProduct