PyPI/tqdm CVE-2024-34062: low 3.9, EPSS 0.44%
tqdm CLI arguments injection attack
Action: Upgrade tqdm to 4.66.3 or later.
pip install tqdm==4.66.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.4.0 | 4.66.3 | - |
Fixed versions
| 4.66.3 |
Sources
- osv: GHSA-g7vv-2v7x-gj9p
- https://github.com/tqdm/tqdm/security/advisories/GHSA-g7vv-2v7x-gj9p
- https://nvd.nist.gov/vuln/detail/CVE-2024-34062
- https://github.com/tqdm/tqdm/commit/4e613f84ed2ae029559f539464df83fa91feb316
- https://github.com/tqdm/tqdm
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PA3GIGHPWAHCTT4UF57LTPZGWHAX3GW6
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRECVQCCESHBS3UJOWNXQUIX725TKNY6
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VA337CYUS4SLRFV2P6MX6MZ2LKFURKJC
CVE-2024-34062 · published · modified · JSON