{"action":"No fix published. Pin and monitor.","affected":[],"component":"exotel","cve_ids":["CVE-2022-38792"],"ecosystem":"PyPI","epss":0.01565,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-cv6j-9835-p7fh","id":"tcs_01M5KGHQCW2DTAWYAESZ1FMA7P","modified_at":"2024-11-25T22:42:07.129346Z","published_at":"2022-08-27T20:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2022-43134","https://github.com/jertel/elastalert2/pull/931","https://inspector.pypi.io/project/exotel/0.1.6/packages/8b/ed/9ebeb34d4adb9b01151d73ccfde9c1cb2d629c3b146953c8727559a65446/exotel-0.1.6.tar.gz/exotel-0.1.6/setup.py","https://pypi.org/project/exotel/","https://github.com/sarathsp06/exotel-py/issues/10"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"PYSEC-2022-43134","url":"https://osv.dev/vulnerability/PYSEC-2022-43134"}],"summary":"The exotel (aka exotel-py) package in PyPI as of 0.1.6 includes a code execution backdoor inserted by a third party."}