PT-2022-3408 · Pypi+1 · Api-Res-Py+1

Published 2022-06-08 · Updated 2022-06-15 · CVE-2022-31313

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions api-res-py package in PyPI version 0.1

Description The issue is related to a code execution backdoor in the request package. This backdoor allows a remote attacker to execute arbitrary code.

Recommendations For api-res-py package in PyPI version 0.1, consider removing or replacing the vulnerable request package to prevent code execution. As a temporary workaround, restrict the use of the request package until a secure alternative or patch is available.

Fix

Hidden Functionality

Weakness Enumeration

CWE-912

Related Identifiers

BDU:2022-04182

CVE-2022-31313

GHSA-6978-4W92-428P

PYSEC-2022-43071

Affected Products

Api-Res-Py

Request

References · 14

• https://bdu.fstec.ru/vul/2022-04182 · Security Note
• https://osv.dev/vulnerability/CVE-2022-31313 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-43071 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31313 · Security Note
• https://osv.dev/vulnerability/GHSA-6978-4w92-428p · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/api-res-py/PYSEC-2022-43071.yaml · Note
• http://pypi.doubanio.com/simple/request · Note
• https://t.me/cvenotify/31326 · Telegram Post
• https://t.me/cibsecurity/44061 · Telegram Post
• https://t.me/true_secator/3055 · Telegram Post
• https://pypi.org/project/api-res-py · Note
• ❌ https://github.com/rakeshrkz7/as_api_res/issues/1 · Note, Deleted
• https://securitylab.ru/news/532253.php · Note
• ❌ https://github.com/rakeshrkz7/as_api_res · Note, Deleted