PyPI/weblate CVE-2022-23915, CVE-2022-24727: high 8.8, EPSS 3.10%

Improper Neutralization of Special Elements used in a Command ('Command Injection') in Weblate

Action: Upgrade weblate to 4.11.1 or later.

pip install weblate==4.11.1

Affected

Fixed versions

Sources

• osv: GHSA-3872-f48p-pxqj
• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-3872-f48p-pxqj
• https://nvd.nist.gov/vuln/detail/CVE-2022-23915
• https://github.com/WeblateOrg/weblate/pull/7337
• https://github.com/WeblateOrg/weblate/pull/7338
• https://github.com/WeblateOrg/weblate/commit/35d59f1f040541c358cece0a8d4a63183ca919b8
• https://github.com/WeblateOrg/weblate/commit/d83672a3e7415da1490334e2c9431e5da1966842
• https://github.com/WeblateOrg/weblate
• https://github.com/WeblateOrg/weblate/releases/tag/weblate-4.11.1
• https://github.com/pypa/advisory-database/tree/main/vulns/weblate/PYSEC-2022-162.yaml
• https://github.com/pypa/advisory-database/tree/main/vulns/weblate/PYSEC-2022-31.yaml
• https://security.snyk.io/vuln/SNYK-PYTHON-WEBLATE-2414088
• https://snyk.io/vuln/SNYK-PYTHON-WEBLATE-2414088

CVE-2022-23915, CVE-2022-24727 · published 2022-03-04T21:15:31Z · modified 2024-11-19T19:04:45.831782Z · JSON