PT-2022-24570 · Pypi · Exotel

Anroots-Two · Published 2022-08-27 · Updated 2022-09-01 · CVE-2022-38792

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions exotel (aka exotel-py) version 0.1.6

Description The exotel package in PyPI includes a code execution backdoor inserted by a third party. This backdoor allows for code execution, posing a significant security risk. Users should be aware of this issue to take appropriate mitigation measures.

Recommendations For version 0.1.6, downgrade to version 0.1.5 to avoid the problem.

Fix

Related Identifiers

CVE-2022-38792

GHSA-CV6J-9835-P7FH

PYSEC-2022-43134

Affected Products

Exotel

References · 12

• https://github.com/jertel/elastalert2/pull/931 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-38792 · Security Note
• https://osv.dev/vulnerability/CVE-2022-38792 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cv6j-9835-p7fh · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-43134 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/exotel/PYSEC-2022-43134.yaml · Note
• https://github.com/sarathsp06/exotel-py/issues/10 · Note
• https://github.com/sarathsp06/exotel-py · Note
• https://inspector.pypi.io/project/exotel/0.1.6/packages/8b/ed/9ebeb34d4adb9b01151d73ccfde9c1cb2d629c3b146953c8727559a65446/exotel-0.1.6.tar.gz/exotel-0.1.6/setup.py · Note
• https://t.me/cibsecurity/48939 · Telegram Post
• https://pypi.org/project/exotel · Note
• https://t.me/cvenotify/35251 · Telegram Post