PyPI/scancodeio CVE-2023-39523: medium 6.8, EPSS 2.92%
ScanCode.io command injection in docker image fetch process
Action: Upgrade scancodeio to 32.5.1 or later.
pip install scancodeio==32.5.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 32.5.1 | - |
Fixed versions
| 32.5.1 |
Sources
- osv: GHSA-2ggp-cmvm-f62f
- https://github.com/nexB/scancode.io/security/advisories/GHSA-2ggp-cmvm-f62f
- https://nvd.nist.gov/vuln/detail/CVE-2023-39523
- https://github.com/nexB/scancode.io/commit/07ec0de1964b14bf085a1c9a27ece2b61ab6105c
- https://github.com/nexB/scancode.io
- https://github.com/nexB/scancode.io/blob/main/scanpipe/pipes/fetch.py#L185
- https://github.com/nexB/scancode.io/releases/tag/v32.5.1
CVE-2023-39523 · published · modified · JSON