Loading HuntDB...
Hunt
Vulnerability Intelligence by wss.sh
Home Daily Briefings High Impact CVEs Recent Exploits KEV Catalog GitHub Advisories Latest Updates Security News
Sign In Sign Up

CVE-2022-21797

HIGH
Published 2022-09-26T05:05:17.410454Z
Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2022-21797. We'll provide specific mitigation strategies based on your environment and risk profile.

CVSS Score

V3.1
7.3
/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P
Base Score Metrics
Exploitability: N/A Impact: N/A

EPSS Score

v2025.03.14
0.001
probability
of exploitation in the wild

There is a 0.1% chance that this vulnerability will be exploited in the wild within the next 30 days.

Updated: 2025-06-25
Exploit Probability
Percentile: 0.293
Higher than 29.3% of all CVEs

Attack Vector Metrics

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED

Impact Metrics

Confidentiality
LOW
Integrity
LOW
Availability
LOW

Description

The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.

Available Exploits

No exploits available for this CVE.

Related News

No news articles found for this CVE.

Affected Products

fedoraproject

fedora

Affected Versions:

36
debian

debian_linux

Affected Versions:

10.0
fedoraproject

fedora

Affected Versions:

37
joblib_project

joblib

Affected Versions:

0

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

✓ GitHub Reviewed CRITICAL

joblib vulnerable to arbitrary code execution

GHSA-6hrg-qmvc-2xh8

Advisory Details

The package joblib from 0 and before 1.2.0 is vulnerable to Arbitrary Code Execution via the `pre_dispatch` flag in `Parallel()` class due to the `eval()` statement.

Affected Packages

PyPI joblib
ECOSYSTEM: ≥0 <1.2.0

CVSS Scoring

CVSS Score

9.0

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2022-21797
WEB https://github.com/joblib/joblib/issues/1128
WEB https://github.com/joblib/joblib/pull/1321
WEB https://github.com/joblib/joblib/pull/1327
WEB https://github.com/joblib/joblib/pull/1352
WEB https://github.com/joblib/joblib/commit/6638b9e9711ad1ebbf6dd95aa7cee0dca9897b42
WEB https://github.com/joblib/joblib/commit/b90f10efeb670a2cc877fb88ebb3f2019189e059
WEB https://security.snyk.io/vuln/SNYK-PYTHON-JOBLIB-3027033
WEB https://security.gentoo.org/glsa/202401-01
WEB https://lists.fedoraproject.org/archives/list/[email protected]/message/MJ5XTJS6OKJRRVXWFN5J67K3BYPEOBDF
WEB https://lists.fedoraproject.org/archives/list/[email protected]/message/BVOMMW37OXZWU2EV5ONAAS462IQEHZOF
WEB https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MJ5XTJS6OKJRRVXWFN5J67K3BYPEOBDF
WEB https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BVOMMW37OXZWU2EV5ONAAS462IQEHZOF
WEB https://lists.debian.org/debian-lts-announce/2023/03/msg00027.html
WEB https://lists.debian.org/debian-lts-announce/2022/11/msg00020.html
WEB https://github.com/pypa/advisory-database/tree/main/vulns/joblib/PYSEC-2022-288.yaml
PACKAGE https://github.com/joblib/joblib

Advisory provided by GitHub Security Advisory Database. Published: September 27, 2022, Modified: September 23, 2024

References

https://security.snyk.io/vuln/SNYK-PYTHON-JOBLIB-3027033
https://github.com/joblib/joblib/commit/b90f10efeb670a2cc877fb88ebb3f2019189e059
https://github.com/joblib/joblib/issues/1128
https://github.com/joblib/joblib/pull/1321
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BVOMMW37OXZWU2EV5ONAAS462IQEHZOF/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MJ5XTJS6OKJRRVXWFN5J67K3BYPEOBDF/
https://lists.debian.org/debian-lts-announce/2022/11/msg00020.html
https://lists.debian.org/debian-lts-announce/2023/03/msg00027.html
https://security.gentoo.org/glsa/202401-01
Published: 2022-09-26T05:05:17.410454Z
Last Modified: 2024-09-17T04:24:12.503Z
Copied to clipboard!