VDB
CVE-2021-34363
CVE-2021-34363
PUBLISHED
CVSS 9.100000381469727 CRITICAL
The thefuck (aka The Fuck) package before 3.31 for Python allows Path Traversal that leads to arbitrary file deletion via the "undo archive operation" feature.
EPSS 1.85% · 77.2th percentile
Risk Scores
CVSS 3.1
9.100000381469727
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
EPSS Score
1.85%
77.2th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:24.04:LTS | thefuck | 3.29-0.3, 0, 3.29-0.3ubuntu1 |
| Ubuntu:16.04:LTS | thefuck | 3.2-1, 0, 2.5.6-1 |
| Ubuntu:18.04:LTS | thefuck | 0, 3.11-2 |
| Ubuntu:22.04:LTS | thefuck | 0, 3.29-0.3 |
| Ubuntu:25.10 | thefuck | 0, 3.32-0.4, 3.32-0.2 |
| Ubuntu:20.04:LTS | thefuck | 3.29-0.1, 0 |
Timeline
- Jun 10, 2021 CVE Published
- Jun 11, 2021 EPSS Score
- Aug 12, 2021 EPSS Score
- Oct 12, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Jan 19, 2022 EPSS Score
- Feb 4, 2022 EPSS Score
- Feb 10, 2022 EPSS Score
- Apr 12, 2022 EPSS Score
- Jun 12, 2022 EPSS Score
- Aug 13, 2022 EPSS Score
- Oct 13, 2022 EPSS Score
References
- https://ubuntu.com/security/CVE-2021-34363 third-party-advisory
- https://github.com/nvbn/thefuck/commit/e343c577cd7da4d304b837d4a07ab4df1e023092 third-party-advisory
- https://github.com/nvbn/thefuck/pull/1206 third-party-advisory
- https://vuln.ryotak.me/advisories/48 third-party-advisory
- https://github.com/nvbn/thefuck/releases/tag/3.31 third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2021-34363 third-party-advisory