CVE-2022-32998: cryptoasset-data-downloader - Code Execution Backdoor
Summary
CVE-2022-32998: The cryptoasset-data-downloader package in PyPI v1.0.0 to v1.0.1 was discovered to contain a code execution backdoor via the request package. Affects cryptoasset-data-downloader versions >= 1.0.0, < 1.0.2. Fixed in 1.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The cryptoasset-data-downloader package is a Python package available on PyPI. It is designed to download and manage data related to cryptoassets, including sensitive user information and digital currency keys. This package is commonly used by developers and organizations working with cryptocurrencies.
Vulnerability Detail
A code execution backdoor was discovered in versions 1.0.0 to 1.0.1 of the cryptoasset-data-downloader package. The vulnerability exists due to a flaw in the request package used by the package. Attackers can exploit this vulnerability to gain unauthorized access to sensitive user information and digital currency keys, as well as escalate privileges. This can lead to significant financial losses and compromise the security of cryptoasset-related operations.
How To Fix
Minimum fixed version
1.0.2
This is the first release that contains the fix.
pip install --upgrade "cryptoasset-data-downloader==1.0.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading to the patched version of the cryptoasset-data-downloader package.
Conclusion
The cryptoasset-data-downloader package in versions 1.0.0 to 1.0.1 is vulnerable to a code execution backdoor. This vulnerability can lead to unauthorized access to sensitive user information and digital currency keys, as well as privilege escalation. It is crucial to upgrade to version 1.0.2 or later of the package to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for cryptoasset-data-downloader →
FAQ
This vulnerability allows attackers to execute arbitrary code, potentially leading to unauthorized access to sensitive user information and digital currency keys. It can also result in privilege escalation, compromising the security of cryptoasset-related operations.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock file, and Vulert will analyze it for any open-source vulnerabilities, including CVE-2022-32998.
No, only versions 1.0.0 to 1.0.1 of the cryptoasset-data-downloader package are affected. The vulnerability has been fixed in version 1.0.2 and later.
While specific exploits for this vulnerability have not been disclosed, it is important to address the issue promptly by upgrading to the patched version of the cryptoasset-data-downloader package.
You can find more information about this vulnerability in the advisory database of the PyPI ecosystem. The source for this vulnerability is available at https://github.com/pypa/advisory-database/blob/main/vulns/cryptoasset-data-downloader/PYSEC-2022-217.yaml.
