PT-2022-37409 · Pypi · Wikifaces

Published 2022-07-22 · Updated 2022-07-22

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions wikifaces package in PyPI version 1.0

Description The issue concerns a code execution backdoor that was inserted by a third party into the wikifaces package available on PyPI. This backdoor allows for unauthorized code execution.

Recommendations For wikifaces package in PyPI version 1.0, avoid using this version due to the presence of a code execution backdoor. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

PYSEC-2022-43173

Affected Products

Wikifaces

References · 4

• https://osv.dev/vulnerability/PYSEC-2022-43173 · Vendor Advisory
• https://github.com/tford9/Wiki-Faces-Downloader/issues/1 · Note
• https://pypi.org/project/wikifaces · Note
• http://pypi.doubanio.com/simple/request · Note