PT-2024-40067 · Pypi · Aiocpa

Published 2024-11-25 · Updated 2024-11-25

Positive Technologies (AI Summary)

CVSS v4.0

8.3

High

Base vector

AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions aiocpa versions prior to the removal from PyPI

Description The issue concerns a user-facing library used for generating color gradients of text, which introduced malicious code in version 0.1.13. This malicious code targets Crypto Pay users by forwarding client credentials to a remote Telegram bot.

Recommendations For all affected versions, there is no information about a newer version that contains a fix for this issue, as all versions have been removed from PyPI.

Fix

Related Identifiers

GHSA-486G-47CC-8WXF

Affected Products

Aiocpa

References · 4

• https://osv.dev/vulnerability/GHSA-486g-47cc-8wxf · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/aiocpa/PYSEC-2024-152.yaml · Note
• https://inspector.pypi.io/project/aiocpa/0.1.13/packages/ab/98/7343281068a2c39086d0b877219668a487508197f46e89b3f41046a4a8ba/aiocpa-0.1.13.tar.gz/aiocpa-0.1.13/cryptopay/utils/sync.py#line.44 · Note
• https://blog.pypi.org/posts/2024-11-25-aiocpa-attack-analysis · Note