CVE-2022-21797: Arbitrary Code Execution
The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the predispatch flag in Parallel() class due to the eval() statement.
Other sources
The package joblib from 0 and before 1.2.0 is vulnerable to Arbitrary Code Execution via the predispatch flag in Parallel() class due to the eval() statement.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/joblibto a version that resolves this vulnerability.Fixed in 1.2.0 - Upgrade
Upgrade
debian/joblibto a version that resolves this vulnerability.Fixed in 1.2.0-4+deb12u1Fixed in 1.4.2-4Fixed in 1.5.3-2 - Upgrade
Upgrade
alpine/py3-joblibto a version that resolves this vulnerability.Fixed in 1.2.0-r0 - Upgrade
Upgrade
debian/joblibto a version that resolves this vulnerability.Fixed in 1.2.0-1 - Upgrade
Upgrade
joblibto a version that resolves this vulnerability.Fixed in 1.2.0
Event History
Frequently Asked Questions
What is the severity of CVE-2022-21797?
CVE-2022-21797 is classified as a high severity vulnerability due to the risk of arbitrary code execution.
How do I fix CVE-2022-21797?
To fix CVE-2022-21797, upgrade the joblib package to version 1.2.0 or higher.
What systems are affected by CVE-2022-21797?
CVE-2022-21797 affects joblib versions from 0 to 1.1.1, specifically those installed via pip and certain Linux distributions like Fedora and Debian.
What type of vulnerability is CVE-2022-21797?
CVE-2022-21797 is an arbitrary code execution vulnerability caused by the misuse of the eval() function in the joblib library.
Can CVE-2022-21797 be exploited remotely?
Yes, CVE-2022-21797 can be exploited remotely if an attacker can control the input parameters sent to the affected joblib function.