Lucene search

MitreCVE-2022-40810

HistorySep 19, 2022 - 4:15 p.m.

CVE-2022-40810

2022-09-1916:15:12

mitre

web.nvd.nist.gov

cve-2022-40810

code-execution

backdoor

democritus-hypothesis

security vulnerability

pypi

python

nvd

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.003

Percentile

69.4%

JSON

The d8s-ip-addresses for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hypothesis package. The affected version is 0.1.0

Affected configurations

Nvd

Node

democritus_ip_addresses_projectdemocritus_ip_addressesMatch0.1.0python

VendorProductVersionCPE
democritus_ip_addresses_projectdemocritus_ip_addresses0.1.0cpe:2.3:a:democritus_ip_addresses_project:democritus_ip_addresses:0.1.0:*:*:*:*:python:*:*

Vendor	Product	Version	CPE
democritus_ip_addresses_project	democritus_ip_addresses	0.1.0	cpe:2.3:a:democritus_ip_addresses_project:democritus_ip_addresses:0.1.0:::::python::

References

github.com/democritus-project/d8s-ip-addresses/issues/13

pypi.org/project/democritus-hypothesis/

Social References

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.003

Percentile

69.4%

JSON

Related for CVE-2022-40810