PT-2024-30246 · Pandas · Pandas

Published 2024-08-23 · Updated 2024-10-01 · CVE-2024-42992

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Pandas version 2.2.2

Description A critical flaw was discovered in the Pandas library, allowing for arbitrary file reads, which risks sensitive data exposure. The library has been downloaded over 54 million times and is a cornerstone tool for data scientists, developers, and analysts across the globe.

Recommendations For Pandas version 2.2.2, limit its use in sensitive environments and stay vigilant until a patch is available. As a temporary workaround, consider restricting access to sensitive files and directories to minimize the risk of exploitation.

Exploit

Related Identifiers

CVE-2024-42992

Affected Products

Pandas

References · 20

• 🔥❌ https://github.com/juwenyi/CVE-2024-42992 · Exploit, Deleted
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-42992 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-42992 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-42992 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-42992 · Security Note
• https://twitter.com/ohhara_shiojiri/status/1827968306025992275 · Twitter Post
• https://twitter.com/CVEnew/status/1827035775445225848 · Twitter Post
• https://twitter.com/moton/status/1828049073263583251 · Twitter Post
• https://twitter.com/Dinosn/status/1827945414101709048 · Twitter Post
• https://twitter.com/socradar/status/1828131723688935850 · Twitter Post
• https://twitter.com/Komodosec/status/1841131737008783494 · Twitter Post
• https://t.me/true_secator/6131 · Telegram Post
• https://twitter.com/HexaSentinel/status/1828123500009103588 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1827891364404908151 · Twitter Post
• https://t.me/cvenotify/92014 · Telegram Post