Veracode Vulnerability DatabaseVERACODE:38044Privilege Escalation
0.0004 Low
EPSS
Percentile
10.1%
python3.10 is vulnerable to privilege escalation. The vulnerability exists when used with the forkserver start method on Linux allows pickles to be deserialized from any user in the same machine local network namespace, which in many system configurations means any user on the same machine which allows an attacker to execute arbitrary codes.
References
github.com/python/cpython/compare/v3.10.8...v3.10.9
github.com/python/cpython/compare/v3.9.15...v3.9.16
github.com/python/cpython/issues/97514
github.com/python/cpython/issues/97514#issuecomment-1310277840
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FKGCQPIVHEAIJ77R3RSNSQWYBUDVWDKU/
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2LHWWEI5OBQ6RELULMVU6KMDYG4WZXH/
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PI5DYIED6U26BGX5IRZWNCP6TY4M2ZGZ/
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QLUGZSEAO3MBWGKCUSMKQIRYJZKJCIOB/
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R6KGIRHSENZ4QAB234Z36HVIDTRJ3MFI/
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RDK3ZZBRYFO47ET3N4BNTKVXN47U6ICY/
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VCRKBB5Y5EWTJUNC7LK665WO64DDXSTN/
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XX6LLAXGZVZ327REY6MDZRMMP47LJ53P/
lists.fedoraproject.org/archives/list/[email protected]/message/FKGCQPIVHEAIJ77R3RSNSQWYBUDVWDKU/
lists.fedoraproject.org/archives/list/[email protected]/message/P2LHWWEI5OBQ6RELULMVU6KMDYG4WZXH/
lists.fedoraproject.org/archives/list/[email protected]/message/PI5DYIED6U26BGX5IRZWNCP6TY4M2ZGZ/
lists.fedoraproject.org/archives/list/[email protected]/message/QLUGZSEAO3MBWGKCUSMKQIRYJZKJCIOB/
lists.fedoraproject.org/archives/list/[email protected]/message/R6KGIRHSENZ4QAB234Z36HVIDTRJ3MFI/
lists.fedoraproject.org/archives/list/[email protected]/message/RDK3ZZBRYFO47ET3N4BNTKVXN47U6ICY/
lists.fedoraproject.org/archives/list/[email protected]/message/VCRKBB5Y5EWTJUNC7LK665WO64DDXSTN/
lists.fedoraproject.org/archives/list/[email protected]/message/XX6LLAXGZVZ327REY6MDZRMMP47LJ53P/
security-tracker.debian.org/tracker/CVE-2022-42919
security.gentoo.org/glsa/202305-02
security.netapp.com/advisory/ntap-20221209-0006/
Related
