Fluid Attacks Database

Description

joblib vulnerable to arbitrary code execution The package joblib from 0 and before 1.2.0 is vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
pypi	joblib	>=0 <1.2.0	1.2.0
debian 12	joblib	>=0 <1.2.0-1	1.2.0-1
debian 13	joblib	>=0 <1.2.0-1	1.2.0-1
debian 14	joblib	>=0 <1.2.0-1	1.2.0-1
debian 11	joblib	=0.17.0-4 \|\| >=0 <0.17.0-4+deb11u1	0.17.0-4+deb11u1

Aliases

1. CVE-2022-217972. NVD-2022-217973. OSV-2022-217974. OSV-DEBIAN-2022-217975. GCVE-2022-217976. security.gentoo.org7. lists.debian.org8. lists.debian.org9. SECURITY-TRACKER-CVE-2022-21797

References

1. https://github.com/joblib/joblib/issues/11282. https://github.com/joblib/joblib/pull/13213. https://github.com/joblib/joblib/pull/13274. https://github.com/joblib/joblib/pull/13525. https://github.com/joblib/joblib/commit/6638b9e9711ad1ebbf6dd95aa7cee0dca9897b426. https://github.com/joblib/joblib/commit/b90f10efeb670a2cc877fb88ebb3f2019189e0597. https://lists.fedoraproject.org/archives/list/[email protected]/message/MJ5XTJS6OKJRRVXWFN5J67K3BYPEOBDF8. https://lists.fedoraproject.org/archives/list/[email protected]/message/BVOMMW37OXZWU2EV5ONAAS462IQEHZOF9. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MJ5XTJS6OKJRRVXWFN5J67K3BYPEOBDF10. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BVOMMW37OXZWU2EV5ONAAS462IQEHZOF11. https://github.com/pypa/advisory-database/tree/main/vulns/joblib/PYSEC-2022-288.yaml

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.