PT-2017-7723 · Tqdm · Tqdm

Jwilk · Published 2017-01-19 · Updated 2022-05-14 · CVE-2016-10075

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions tqdm versions 4.4.1 through 4.10

Description The issue allows local users to execute arbitrary code via a crafted repository with a malicious git log in the current working directory. This is possible due to a flaw in the tqdm. version module.

Recommendations For versions 4.4.1 through 4.10, consider disabling the tqdm. version module as a temporary workaround until a patch is available. Restrict access to the current working directory to minimize the risk of exploitation. Avoid using the tqdm library in environments where a malicious git log could be present until the issue is resolved.

Fix

Code Injection

Weakness Enumeration

CWE-17

CWE-94

Related Identifiers

CVE-2016-10075

GHSA-R7Q7-XCJW-QX8Q

OPENSUSE-SU-2024:11276-1

PYSEC-2017-74

Affected Products

Tqdm

References · 17

• https://github.com/tqdm/tqdm/issues/328 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-10075 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-10075 · Vendor Advisory
• https://security.gentoo.org/glsa/201807-01 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-10075 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-10075 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-10075 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-10075 · Security Note
• https://osv.dev/vulnerability/CVE-2016-10075 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r7q7-xcjw-qx8q · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2017-74 · Vendor Advisory
• https://github.com/tqdm/tqdm · Note
• https://github.com/tqdm/tqdm/pull/330 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tqdm/PYSEC-2017-74.yaml · Note
• http://securityfocus.com/bid/95143 · Note