CVE-2022-21187
4 advisories.
PyPI/libvcs CVE-2022-21187: high 8.1, EPSS 3.62%
Command injection in libvcs and vcspull
Action: Upgrade libvcs to 0.11.1 or later.
pip install libvcs==0.11.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.11.1 | - |
Fixed versions
| 0.11.1 |
Sources
- osv: GHSA-mv2w-4jqc-6fg4
- https://nvd.nist.gov/vuln/detail/CVE-2022-21187
- https://github.com/vcs-python/libvcs/pull/306
- https://github.com/vcs-python/vcspull/commit/e1b77128a1fa0754625b5f43d8bc47956f21f33e
- https://github.com/pypa/advisory-database/tree/main/vulns/libvcs/PYSEC-2022-163.yaml
- https://github.com/vcs-python/libvcs/blob/master/CHANGES#libvcs-0111-2022-03-12
- https://github.com/vcs-python/libvcs/blob/v0.11.1/CHANGES%23libvcs-0111-2022-03-12
- https://github.com/vcs-python/vcspull/blob/master/CHANGES#vcspull-1111-2022-03-12
- https://snyk.io/vuln/SNYK-PYTHON-LIBVCS-2421204
CVE-2022-21187 · published · modified · JSON
PyPI/vcspull CVE-2022-21187: high 8.1, EPSS 3.62%
Command injection in libvcs and vcspull
Action: Upgrade vcspull to 1.11.1 or later.
pip install vcspull==1.11.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.11.1 | - |
Fixed versions
| 1.11.1 |
Sources
- osv: GHSA-mv2w-4jqc-6fg4#PyPI/vcspull
- https://nvd.nist.gov/vuln/detail/CVE-2022-21187
- https://github.com/vcs-python/libvcs/pull/306
- https://github.com/vcs-python/vcspull/commit/e1b77128a1fa0754625b5f43d8bc47956f21f33e
- https://github.com/pypa/advisory-database/tree/main/vulns/libvcs/PYSEC-2022-163.yaml
- https://github.com/vcs-python/libvcs/blob/master/CHANGES#libvcs-0111-2022-03-12
- https://github.com/vcs-python/libvcs/blob/v0.11.1/CHANGES%23libvcs-0111-2022-03-12
- https://github.com/vcs-python/vcspull/blob/master/CHANGES#vcspull-1111-2022-03-12
- https://snyk.io/vuln/SNYK-PYTHON-LIBVCS-2421204
CVE-2022-21187 · published · modified · JSON
PyPI/libvcs CVE-2022-21187: unknown, EPSS 3.62%
The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the update_repo function (when using hg), the url parameter is passed to the hg clone command.
Action: Upgrade libvcs to 0.11.1 or later.
pip install libvcs==0.11.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.11.1 | - |
Fixed versions
| 0.11.1 |
Sources
- osv: PYSEC-2022-163
- https://github.com/vcs-python/libvcs/pull/306
- https://github.com/vcs-python/libvcs/blob/v0.11.1/CHANGES%23libvcs-0111-2022-03-12
- https://snyk.io/vuln/SNYK-PYTHON-LIBVCS-2421204
CVE-2022-21187 · published · modified · JSON
PyPI/vcspull CVE-2022-21187: high 8.1, EPSS 3.62%
Command injection in libvcs and vcspull
Action: Upgrade vcspull to 1.11.1 or later.
pip install vcspull==1.11.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.11.1 | - |
Fixed versions
| 1.11.1 |
Sources
- osv: PYSEC-2026-563
- https://nvd.nist.gov/vuln/detail/CVE-2022-21187
- https://github.com/vcs-python/libvcs/pull/306
- https://github.com/vcs-python/vcspull/commit/e1b77128a1fa0754625b5f43d8bc47956f21f33e
- https://github.com/pypa/advisory-database/tree/main/vulns/libvcs/PYSEC-2022-163.yaml
- https://github.com/vcs-python/libvcs/blob/master/CHANGES#libvcs-0111-2022-03-12
- https://github.com/vcs-python/libvcs/blob/v0.11.1/CHANGES%23libvcs-0111-2022-03-12
- https://github.com/vcs-python/vcspull/blob/master/CHANGES#vcspull-1111-2022-03-12
- https://snyk.io/vuln/SNYK-PYTHON-LIBVCS-2421204
- https://pypi.org/project/vcspull
- https://github.com/advisories/GHSA-mv2w-4jqc-6fg4
CVE-2022-21187 · published · modified · JSON