CVE-2022-21699
Published: 19 January 2022
IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Affected versions are subject to an arbitrary code execution vulnerability achieved by not properly managing cross user temporary files. This vulnerability allows one user to run code as another on the same machine. All users are advised to upgrade.
Priority
Status
Package | Release | Status |
---|---|---|
ipython Launchpad, Ubuntu, Debian |
bionic |
Released
(5.5.0-1ubuntu0.1~esm1)
Available with Ubuntu Pro |
focal |
Released
(7.13.0-1ubuntu0.1~esm1)
Available with Ubuntu Pro |
|
hirsute |
Ignored
(end of life)
|
|
impish |
Ignored
(end of life)
|
|
jammy |
Not vulnerable
(7.31.1-1)
|
|
kinetic |
Not vulnerable
(7.31.1-1)
|
|
lunar |
Not vulnerable
(8.5.0-4)
|
|
mantic |
Not vulnerable
(8.5.0-4)
|
|
noble |
Not vulnerable
(8.5.0-4)
|
|
trusty |
Ignored
(changes too intrusive)
|
|
upstream |
Released
(8.0.1, 7.31.1, 5.11)
|
|
xenial |
Ignored
(changes too intrusive)
|
|
Patches: upstream: https://github.com/ipython/ipython/commit/46a51ed69cdf41b4333943d9ceeb945c4ede5668 |
Severity score breakdown
Parameter | Value |
---|---|
Base score | 8.8 |
Attack vector | Local |
Attack complexity | Low |
Privileges required | Low |
User interaction | None |
Scope | Changed |
Confidentiality | High |
Integrity impact | High |
Availability impact | High |
Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
References
- https://ipython.readthedocs.io/en/stable/whatsnew/version8.html#ipython-8-0-1-cve-2022-21699
- https://github.com/ipython/ipython/security/advisories/GHSA-pq7m-3gw7-gq5x
- https://github.com/ipython/ipython/commit/46a51ed69cdf41b4333943d9ceeb945c4ede5668
- https://ubuntu.com/security/notices/USN-5953-1
- https://www.cve.org/CVERecord?id=CVE-2022-21699
- NVD
- Launchpad
- Debian