PT-2022-17711 · Poetry · Poetry

Paul Gerste · CVE-2022-26184 · Published 2022-03-21 · Updated 2023-10-24

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Poetry versions 1.1.9 and below

Description The issue is related to an untrusted search path in Poetry, which causes the application to behave in unexpected ways when users execute Poetry commands in a directory containing malicious content. This occurs when the application is run on Windows OS.

Recommendations For versions 1.1.9 and below, update to a version above 1.1.9 to resolve the issue. As a temporary workaround, consider avoiding the execution of Poetry commands in directories that may contain malicious content.

Exploit

Fix

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

CVE-2022-26184

GHSA-XR2C-5W89-63PV

PYSEC-2022-234

Affected Products

Poetry

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/26xxx/CVE-2022-26184.json · Exploit
• https://github.com/python-poetry/poetry-core/pull/205/commits/fa9cb6f358ae840885c700f954317f34838caba7 · Patch
• https://ubuntu.com/security/CVE-2022-26184 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-234 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-26184 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-26184 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-26184 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xr2c-5w89-63pv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-26184 · Vendor Advisory
• https://github.com/python-poetry/poetry/releases/tag/1.1.9 · Note
• https://github.com/python-poetry/poetry-core/commit/1e1a109a1009daaab2367ce90c997f0cbbb0c1d1 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/poetry/PYSEC-2022-234.yaml · Note
• https://github.com/advisories/GHSA-xr2c-5w89-63pv · Note
• https://sonarsource.com/blog/securing-developer-tools-package-managers · Note
• https://t.me/cvenotify/59921 · Telegram Post