{"action":"Upgrade patchelf to 0.16.1.0 or later.","affected":[{"fixed":"0.16.1.0","introduced":"0"}],"component":"patchelf","cve_ids":["CVE-2022-44940"],"ecosystem":"PyPI","epss":0.01092,"exploited":false,"fixed_versions":["0.16.1.0"],"ghsa_id":"GHSA-5pcj-3m26-w633","id":"tcs_01M5KGHRRRR241FBFN6YF9M67A","modified_at":"2024-11-25T22:42:12.915518Z","published_at":"2022-12-19T22:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2022-43144","https://github.com/NixOS/patchelf/pull/419"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"PYSEC-2022-43144","url":"https://osv.dev/vulnerability/PYSEC-2022-43144"}],"summary":"Patchelf v0.9 was discovered to contain an out-of-bounds read via the function modifyRPath at src/patchelf.cc."}