CVE-2022-34054: Perdido Package Code Execution Backdoor
Summary
CVE-2022-34054: The Perdido package in PyPI v0.0.1 to v0.0.2 was discovered to contain a code execution backdoor via the request package. Affects perdido versions >= 0.0.1, < 0.0.3. Fixed in 0.0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Perdido package is a Python package available on PyPI. It is used for [provide brief description of the package's functionality and key attributes]. However, versions 0.0.1 to 0.0.2 of the Perdido package contain a code execution backdoor vulnerability, which can be exploited via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
Vulnerability Detail
The vulnerability in the Perdido package arises from a code execution backdoor that exists in versions 0.0.1 to 0.0.2. Attackers can exploit this backdoor by utilizing the request package. By exploiting this vulnerability, attackers can gain unauthorized access to sensitive user information and digital currency keys. Additionally, they can escalate their privileges within the affected system. This poses a significant risk to the confidentiality, integrity, and availability of the system and its data.
How To Fix
Minimum fixed version
0.0.3
This is the first release that contains the fix.
pip install --upgrade "perdido==0.0.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version (0.0.3) as soon as possible to ensure the security of the system.
Conclusion
The Perdido package versions 0.0.1 to 0.0.2 contain a code execution backdoor vulnerability that can be exploited via the request package. This vulnerability allows attackers to access sensitive user information, digital currency keys, and escalate privileges. To mitigate this vulnerability, it is recommended to upgrade to version 0.0.3 or later of the Perdido package. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for perdido →
FAQ
This vulnerability allows attackers to execute arbitrary code, access sensitive user information, and escalate privileges within the affected system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock, and Vulert will analyze it for any open-source vulnerabilities, including this one.
No, only versions 0.0.1 to 0.0.2 of the Perdido package are affected. Version 0.0.3 and later contain the necessary fixes to address the vulnerability.
While there is no known public exploit at the moment, it is crucial to update to the fixed version (0.0.3) to prevent any potential exploitation.
Yes, this vulnerability can be exploited remotely by attackers who have access to the affected system.
