PyPI/pdm CVE-2023-45805: high 7.8, EPSS 0.45%
PDM Trojan Lockfile
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 2.9.3 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-j44v-mmf2-xvm9
- https://github.com/pdm-project/pdm/security/advisories/GHSA-j44v-mmf2-xvm9
- https://nvd.nist.gov/vuln/detail/CVE-2023-45805
- https://github.com/pdm-project/pdm/commit/6853e2642dfa281d4a9958fbc6c95b7e32d84831
- https://github.com/frostming/unearth/blob/eca170d9370ac5032f2e497ee9b1b63823d3fe0f/src/unearth/evaluator.py#L215-L229
- https://github.com/pdm-project/pdm
- https://github.com/pdm-project/pdm/blob/45d1dfa47d4900c14a31b9bb761e4c46eb5c9442/src/pdm/models/candidates.py#L98-L99
- https://peps.python.org/pep-0440/#post-release-spelling
CVE-2023-45805 · published · modified · JSON