pyenv up to 2.3.2 .python-version path traversal

Summaryinfo

A vulnerability described as critical has been identified in pyenv up to 2.3.2. The affected element is an unknown function of the file .python-version. Executing a manipulation can lead to path traversal. The identification of this vulnerability is CVE-2022-35861. The attack can only be executed locally. There is no exploit available. A patch should be applied to remediate this issue.

Detailsinfo

A vulnerability has been found in pyenv up to 2.3.2 and classified as critical. This vulnerability affects an unknown code block of the file .python-version. The manipulation with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-23. The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

pyenv 1.2.24 through 2.3.2 allows local users to gain privileges via a .python-version file in the current working directory. An attacker can craft a Python version string in .python-version to execute shims under their control. (Shims are executables that pass a command along to a specific version of pyenv. The version string is used to construct the path to the command, and there is no validation of whether the version specified is a valid version. Thus, relative path traversal can occur.)

The weakness was shared 07/18/2022 as 22fa683571d98b59ea16e5fe48ac411c67939653. The advisory is available at github.com. This vulnerability was named CVE-2022-35861 since 07/13/2022. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1006 by the MITRE ATT&CK project.

Applying the patch 22fa683571d98b59ea16e5fe48ac411c67939653 is able to eliminate this problem. The bugfix is ready for download at github.com.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• pyenv

Version

• 2.3.0
• 2.3.1
• 2.3.2

License

• open-source

Website

• Product: https://github.com/pyenv/pyenv/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion