PyPI/mindsdb CVE-2022-23522: high 8.5, EPSS 0.88%

Arbitrary file write in mindsdb when Extracting Tarballs retrieved from a remote location

Action: Upgrade mindsdb to 22.11.4.3 or later.

pip install mindsdb==22.11.4.3

Affected

Fixed versions

Sources

• osv: GHSA-7x45-phmr-9wqp
• https://github.com/mindsdb/mindsdb/security/advisories/GHSA-7x45-phmr-9wqp
• https://nvd.nist.gov/vuln/detail/CVE-2022-23522
• https://github.com/mindsdb/mindsdb
• https://github.com/mindsdb/mindsdb/blob/69c76e727b8067f32b06ab83bb835a8c416c4f21/mindsdb/interfaces/storage/fs.py
• https://github.com/mindsdb/mindsdb/blob/69c76e727b8067f32b06ab83bb835a8c416c4f21/mindsdb/interfaces/storage/fs.py#L128..L129
• https://github.com/mindsdb/mindsdb/releases/tag/v22.11.4.3
• https://github.com/pypa/advisory-database/tree/main/vulns/mindsdb/PYSEC-2023-26.yaml

CVE-2022-23522 · published 2023-03-30T20:16:33Z · modified 2024-10-01T19:36:05.860889Z · JSON