PT-2022-37398 · Pypi · Pyanxdns

Published 2022-06-08 · Updated 2022-06-08

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pyanxdns package in PyPI version 0.2

Description The pyanxdns package has a code execution backdoor, allowing for the execution of arbitrary code remotely. This issue arises when installing version 0.2 of the pyanxdns package, which also installs the request package.

Recommendations For pyanxdns package version 0.2, avoid installing this version to prevent potential code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

PYSEC-2022-43147

Affected Products

Pyanxdns

References · 4

• https://osv.dev/vulnerability/PYSEC-2022-43147 · Vendor Advisory
• https://pypi.org/project/pyanxdns · Note
• https://github.com/egeback/pyanxdns/issues/1 · Note
• http://pypi.doubanio.com/simple/request · Note