PT-2022-27858 · Unknown · Pig-Vector

Jonathan Leitschuh · Published 2022-12-21 · Updated 2022-12-29 · CVE-2022-4641

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions pig-vector (affected versions not specified)

Description A vulnerability was found in pig-vector, classified as problematic, affecting the LogisticRegression function of the file src/main/java/org/apache/mahout/pig/LogisticRegression.java. This issue leads to an insecure temporary file and requires a local attack approach.

Recommendations To fix this issue, it is recommended to apply a patch. The name of the patch is 1e7bd9fab5401a2df18d2eabd802adcf0dcf1f15. As a temporary workaround, consider disabling the LogisticRegression function until a patch is available.

Fix

Weakness Enumeration

CWE-377

Related Identifiers

CVE-2022-4641

Affected Products

Pig-Vector

References · 6

• https://github.com/tdunning/pig-vector/commit/1e7bd9fab5401a2df18d2eabd802adcf0dcf1f15 · Patch
• https://github.com/tdunning/pig-vector/pull/2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-4641 · Security Note
• https://osv.dev/vulnerability/CVE-2022-4641 · Vendor Advisory
• https://t.me/cibsecurity/55097 · Telegram Post
• https://vuldb.com/?id.216500 · Note