VDB
CVE-2021-34363
CVE-2021-34363
PUBLISHED
CVSS 9.100000381469727 CRITICAL
The thefuck (aka The Fuck) package before 3.31 for Python allows Path Traversal that leads to arbitrary file deletion via the "undo archive operation" feature.
EPSS 1.85% · 78.9th percentile
Risk Scores
CVSS 3.1
9.100000381469727
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
EPSS Score
1.85%
78.9th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:24.04:LTS | thefuck | 3.29-0.3, 0, 3.29-0.3ubuntu1 |
| Ubuntu:16.04:LTS | thefuck | 3.2-1, 0, 2.5.6-1 |
| Ubuntu:18.04:LTS | thefuck | 0, 3.11-2 |
| Ubuntu:22.04:LTS | thefuck | 0, 3.29-0.3 |
| Ubuntu:25.10 | thefuck | 0, 3.32-0.4, 3.32-0.2 |
| Ubuntu:20.04:LTS | thefuck | 3.29-0.1, 0 |
Timeline
- Jun 10, 2021 CVE Published
- Jun 11, 2021 EPSS Score
- Aug 12, 2021 EPSS Score
- Oct 13, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Jan 19, 2022 EPSS Score
- Feb 4, 2022 EPSS Score
- Feb 12, 2022 EPSS Score
- Apr 15, 2022 EPSS Score
- Jun 15, 2022 EPSS Score
- Aug 16, 2022 EPSS Score
- Oct 17, 2022 EPSS Score
References
- https://vuln.ryotak.me/advisories/48 third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2021-34363 third-party-advisory
- https://ubuntu.com/security/CVE-2021-34363 advisory
- https://github.com/nvbn/thefuck/commit/e343c577cd7da4d304b837d4a07ab4df1e023092 fix
- https://github.com/nvbn/thefuck/pull/1206 fix
- https://github.com/nvbn/thefuck/releases/tag/3.31 fix