Critical Dependency Confusion Vulnerability in PDM Package Manager
Summary
CVE-2023-45805: pdm is a Python package and dependency manager supporting the latest PEP standards. Affects pdm across 2 version ranges.
< 09f43308923ae27842d2be8fba7e58b606fba253
< 6853e2642dfa281d4a9958fbc6c95b7e32d84831
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PDM (Python Development Master) is a modern Python package and dependency manager that adheres to the latest PEP standards. It simplifies the management of Python packages and their dependencies, allowing developers to specify project requirements in a structured manner. However, PDM is vulnerable to a dependency confusion attack, where a malicious pdm.lock file can be crafted to install unintended packages, potentially leading to security breaches.
Vulnerability Detail
The vulnerability arises from the way PDM processes package versions and names. An attacker can create a malicious package that appears to be a legitimate dependency by manipulating the versioning scheme. For instance, a project named 'foo' can be tricked into installing 'foo-2' instead of the intended 'foo', as PDM does not enforce strict name matching. This can lead to arbitrary code execution during installation, as the installed package may not match the expected one. Additionally, this vulnerability can facilitate downgrade attacks by altering the version number in the pdm.lock file, allowing attackers to revert to a less secure version of a package.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There are currently no known workarounds for this vulnerability other than upgrading to the fixed version. Users should avoid using untrusted or unknown packages until they can upgrade.
Conclusion
The vulnerability identified in PDM poses significant risks to applications that rely on this package manager for dependency management. Users are strongly advised to upgrade to version 2.9.4 or later to mitigate these risks. Regular monitoring of dependencies and using tools like Vulert can help maintain security in open-source projects.
See every vulnerability recorded for pdm →
FAQ
The CVSS score of this vulnerability is 7.8, indicating a high severity level.
You can use Vulert, which monitors open-source vulnerabilities in your software by analyzing a manifest file like package-lock.json. Visit the Vulert playground at Vulert Scanner to check your application without any signup.
The consequences include the installation of malicious packages, arbitrary code execution, and potential security breaches in applications relying on PDM for dependency management.
While the primary risk is related to security breaches and arbitrary code execution, there is a potential for data loss if malicious code is executed during the installation of a compromised package.
If you cannot upgrade immediately, avoid using untrusted packages and monitor your dependencies closely for any suspicious activity.
References
Related vulnerabilities
Recent vulnerabilities recorded for pdm.
