PT-2022-22974 · Pyenv · Pyenv

Comrumino · Published 2022-07-17 · Updated 2023-03-03 · CVE-2022-35861

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pyenv versions 1.2.24 through 2.3.2

Description The issue allows local users to gain privileges via a .python-version file in the current working directory. An attacker can craft a Python version string in .python-version to execute shims under their control. Shims are executables that pass a command along to a specific version of pyenv. The version string is used to construct the path to the command, and there is no validation of whether the version specified is a valid version, thus allowing relative path traversal to occur.

Recommendations For pyenv versions 1.2.24 through 2.3.2, consider disabling the execution of shims based on version strings from .python-version files until a patch is available. Restrict access to the .python-version file to minimize the risk of exploitation. Avoid using crafted Python version strings in .python-version files to prevent relative path traversal.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-35861

OPENSUSE-SU-2022:10183-1

OPENSUSE-SU-2024:12200-1

Affected Products

Pyenv

References · 9

• https://github.com/pyenv/pyenv/commit/22fa683571d98b59ea16e5fe48ac411c67939653 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2022:10183-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-35861 · Security Note
• https://osv.dev/vulnerability/CVE-2022-35861 · Vendor Advisory
• https://lists.opensuse.org/archives/list/[e-mail]/thread/IDXGUII5AFV4IIRR3AESPKYMZT4THLRR · Note
• https://bugzilla.suse.com/1201582 · Note
• https://t.me/cibsecurity/46403 · Telegram Post
• https://t.me/cvenotify/33241 · Telegram Post
• https://suse.com/security/cve/CVE-2022-35861 · Note