VDB
CVE-2022-35861
CVE-2022-35861
PUBLISHED
CVSS 7.800000190734863 HIGH
pyenv 1.2.24 through 2.3.2 allows local users to gain privileges via a .python-version file in the current working directory. An attacker can craft a Python version string in .python-version to execute shims under their control. (Shims are executables that pass a command along to a specific version of pyenv. The version string is used to construct the path to the command, and there is no validation of whether the version specified is a valid version. Thus, relative path traversal can occur.)
EPSS 0.29% · 21.1th percentile
Risk Scores
CVSS 3.1
7.800000190734863
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score
0.29%
21.1th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
| pyenv | pyenv | 1.2.24 |
Timeline
- Jul 17, 2022 CVE Published
- Jul 18, 2022 EPSS Score
- Sep 4, 2022 EPSS Score
- Oct 21, 2022 EPSS Score
- Dec 8, 2022 EPSS Score
- Jan 25, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Mar 13, 2023 EPSS Score
- Apr 30, 2023 EPSS Score
- Jun 17, 2023 EPSS Score
- Aug 3, 2023 EPSS Score
- Sep 20, 2023 EPSS Score