PyPI/marcador CVE-2022-28470: critical 9.8, EPSS 2.27%

Code-execution backdoor in marcador

Action: Upgrade marcador to 0.14 or later.

pip install marcador==0.14

Affected

Fixed versions

Sources

• osv: GHSA-57qv-h9m7-jxfg
• https://nvd.nist.gov/vuln/detail/CVE-2022-28470
• https://github.com/joajfreitas/marcador/issues/5
• https://github.com/joajfreitas/marcador/commit/84d84549c6c6d765abc9243ac7e85d810f32d6e7
• https://github.com/advisories/GHSA-57qv-h9m7-jxfg
• https://github.com/joajfreitas/marcador
• https://github.com/pypa/advisory-database/tree/main/vulns/marcador/PYSEC-2022-185.yaml
• https://pypi.org/project/marcador
• http://pypi.doubanio.com/simple/request

CVE-2022-28470 · published 2022-05-09T00:00:48Z · modified 2024-11-30T05:43:39.455150Z · JSON