CVE-2022-21699

2022-01-1922:15:09

Debian Security Bug Tracker

security-tracker.debian.org

ipython

arbitrary code execution

cross user vulnerability

temporary files

upgrade

unix

CVSS2

4.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS

0.001

Percentile

29.4%

JSON

IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Affected versions are subject to an arbitrary code execution vulnerability achieved by not properly managing cross user temporary files. This vulnerability allows one user to run code as another on the same machine. All users are advised to upgrade.

OSVersionArchitecturePackageVersionFilename
Debian12allipython< 7.31.1-1ipython_7.31.1-1_all.deb
Debian11allipython< 7.20.0-1+deb11u1ipython_7.20.0-1+deb11u1_all.deb
Debian999allipython< 7.31.1-1ipython_7.31.1-1_all.deb
Debian13allipython< 7.31.1-1ipython_7.31.1-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	ipython	< 7.31.1-1	ipython_7.31.1-1_all.deb
Debian	11	all	ipython	< 7.20.0-1+deb11u1	ipython_7.20.0-1+deb11u1_all.deb
Debian	999	all	ipython	< 7.31.1-1	ipython_7.31.1-1_all.deb
Debian	13	all	ipython	< 7.31.1-1	ipython_7.31.1-1_all.deb