PyPI/pipreqs CVE-2023-31543: critical 9.8, EPSS 1.19%

pipreqs vulnerable to Dependency Confusion

Action: Upgrade pipreqs to 0.4.12 or later.

pip install pipreqs==0.4.12

Affected

Fixed versions

Sources

• osv: GHSA-v4f4-23wc-99mh
• https://nvd.nist.gov/vuln/detail/CVE-2023-31543
• https://github.com/bndr/pipreqs/pull/364
• https://github.com/bndr/pipreqs/commit/3f5964fcb90ec6eb6df46d78e651a1b73538d0ba
• https://gist.github.com/adeadfed/ccc834440af354a5638f889bee34bafe
• https://github.com/bndr/pipreqs
• https://github.com/bndr/pipreqs/blob/master/pipreqs/pipreqs.py#L447-L449
• https://github.com/pypa/advisory-database/tree/main/vulns/pipreqs/PYSEC-2023-99.yaml

CVE-2023-31543 · published 2023-06-30T21:30:26Z · modified 2024-10-14T18:48:38.278705Z · JSON