{"action":"Upgrade mindsdb to 22.11.4.3 or later.","affected":[{"fixed":"22.11.4.3","introduced":"0"}],"component":"mindsdb","cve_ids":["CVE-2022-23522"],"ecosystem":"PyPI","epss":0.00883,"exploited":false,"fixed_versions":["22.11.4.3"],"ghsa_id":"GHSA-7x45-phmr-9wqp","id":"tcs_01M5KF6SSFNDAH8D7V37YRRVHW","modified_at":"2024-10-01T19:36:05.860889Z","published_at":"2023-03-30T20:16:33Z","references":["https://osv.dev/vulnerability/GHSA-7x45-phmr-9wqp","https://github.com/mindsdb/mindsdb/security/advisories/GHSA-7x45-phmr-9wqp","https://nvd.nist.gov/vuln/detail/CVE-2022-23522","https://github.com/mindsdb/mindsdb","https://github.com/mindsdb/mindsdb/blob/69c76e727b8067f32b06ab83bb835a8c416c4f21/mindsdb/interfaces/storage/fs.py","https://github.com/mindsdb/mindsdb/blob/69c76e727b8067f32b06ab83bb835a8c416c4f21/mindsdb/interfaces/storage/fs.py#L128..L129","https://github.com/mindsdb/mindsdb/releases/tag/v22.11.4.3","https://github.com/pypa/advisory-database/tree/main/vulns/mindsdb/PYSEC-2023-26.yaml"],"severity":{"label":"high","score":8.5},"sources":[{"source":"osv","source_id":"GHSA-7x45-phmr-9wqp","url":"https://osv.dev/vulnerability/GHSA-7x45-phmr-9wqp"}],"summary":"Arbitrary file write in mindsdb when Extracting Tarballs retrieved from a remote location"}