{"action":"No fix published. Pin and monitor.","affected":[],"component":"aiocpa","cve_ids":[],"ecosystem":"PyPI","exploited":false,"fixed_versions":[],"id":"tcs_01M5KGM57KTC6GJS8WZJ4SGVSR","modified_at":"2024-11-25T19:30:00Z","published_at":"2024-11-25T19:30:00Z","references":["https://osv.dev/vulnerability/PYSEC-2024-152","https://inspector.pypi.io/project/aiocpa/0.1.13/packages/ab/98/7343281068a2c39086d0b877219668a487508197f46e89b3f41046a4a8ba/aiocpa-0.1.13.tar.gz/aiocpa-0.1.13/cryptopay/utils/sync.py#line.44","https://blog.pypi.org/posts/2024-11-25-aiocpa-attack-analysis/"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2024-152","url":"https://osv.dev/vulnerability/PYSEC-2024-152"}],"summary":"aiocpa 0.1.13 contains credential harvesting code"}