PT-2022-25544 · Pypi · Democritus-Hypothesis+1

Di1L0O · Published 2022-09-19 · Updated 2022-09-21 · CVE-2022-40805

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions d8s-urls version 0.1.0 democritus-hypothesis (affected versions not specified)

Description A potential code-execution backdoor was inserted by a third party in the d8s-urls package for python, distributed on PyPI. Additionally, the democritus-hypothesis package also contains a potential code execution backdoor inserted by third parties.

Recommendations For d8s-urls version 0.1.0, consider removing or avoiding the use of this version due to the potential code-execution backdoor. For democritus-hypothesis, as the affected versions are not specified, it is recommended to exercise caution when using this package and to monitor for any updates or advisories regarding the potential code execution backdoor. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2022-40805

Affected Products

D8S-Urls

Democritus-Hypothesis

References · 5

• 🔥 https://github.com/democritus-project/d8s-urls/issues/10 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-40805 · Security Note
• https://osv.dev/vulnerability/CVE-2022-40805 · Vendor Advisory
• https://t.me/cvenotify/36444 · Telegram Post
• https://pypi.org/project/democritus-hypothesis · Note