PDM Trojan Lockfile Vulnerability in pdm
Summary
CVE-2023-45805: PDM Trojan Lockfile. Affects pdm versions < 2.9.3. No fix is published. How to fix ↓
Also tracked for
- pdm · Debian:12
The same CVE-2023-45805 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PDM is a package manager for Python that aims to be a faster and more reliable alternative to pip. It provides features such as deterministic builds, parallel installation, and a lockfile to ensure reproducibility. However, a vulnerability has been discovered in PDM's handling of lockfiles, which could allow an attacker to install a different package than intended by crafting a malicious pdm.lock file.
Vulnerability Detail
The vulnerability arises from the fact that PDM does not verify the version of a package being installed against the version specified in the lockfile. This allows an attacker to create a project with a similar name to a trusted project and upload a malicious package with a different version. PDM will interpret this as the trusted project with a different version, leading to the installation of the malicious package. This can be exploited by insiders or malicious open source projects to execute arbitrary code during installation or perform downgrade attacks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is currently no known workaround for this vulnerability. It is recommended to update to a fixed version of PDM once it becomes available.
Conclusion
The PDM Trojan Lockfile vulnerability in pdm allows an attacker to install a different package than intended by crafting a malicious pdm.lock file. This can lead to arbitrary code execution during installation or downgrade attacks. It is recommended to update to a fixed version of PDM once available. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for pdm →
FAQ
PDM is a package manager for Python that provides features such as deterministic builds and parallel installation.
The vulnerability allows an attacker to craft a malicious pdm.lock file that can cause PDM to install a different package than intended.
An attacker can execute arbitrary code during installation or perform downgrade attacks by exploiting this vulnerability.
Currently, there is no known workaround for this vulnerability. It is recommended to update to a fixed version of PDM once available.
To protect your project, ensure that you are using a fixed version of PDM once it becomes available. Regularly update your dependencies and monitor for any security advisories.
References
Related vulnerabilities
Recent vulnerabilities recorded for pdm.
