{"action":"Upgrade reqmon to 2.0.4 or later.","affected":[{"fixed":"2.0.4","introduced":"1.4.1rc5"}],"component":"reqmon","cve_ids":["CVE-2022-34558"],"ecosystem":"PyPI","epss":0.01299,"exploited":false,"fixed_versions":["2.0.4"],"ghsa_id":"GHSA-4vq7-8699-4xgc","id":"tcs_01M5KGHV24Z9NEZJAV1G4J652P","modified_at":"2026-07-01T21:45:49.131126973Z","published_at":"2022-07-28T23:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2022-43163","https://github.com/dmwm/WMCore/issues/11188"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"PYSEC-2022-43163","url":"https://osv.dev/vulnerability/PYSEC-2022-43163"}],"summary":"WMAgent v1.3.3rc2 and 1.3.3rc1, reqmgr 2 1.4.1rc5 and 1.4.0rc2, reqmon 1.4.1rc5, and global-workqueue 1.4.1rc5 allows attackers to execute arbitrary code via a crafted dbs-client package."}