Critical Vulnerability in PDM Package: Malicious Dependency Installation Risk
Summary
DEBIAN-CVE-2023-45805: pdm is a Python package and dependency manager supporting the latest PEP standards. Affects pdm versions < 2.20.0.post1+ds1-1. Fixed in 2.20.0.post1+ds1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PDM (Python Development Master) is a modern Python package and dependency manager that supports the latest PEP standards, facilitating the management of project dependencies in a streamlined manner. It allows developers to define and install packages efficiently, ensuring compatibility with Python's evolving ecosystem. However, a significant vulnerability has been identified that could compromise the integrity of installed dependencies.
Vulnerability Detail
The vulnerability arises from the ability to craft a malicious 'pdm.lock' file that can mislead PDM into installing a different package than intended. An attacker can create a project with a name similar to a trusted package, allowing them to exploit the versioning system. For instance, a project named 'foo-2' could be uploaded to PyPI, which PDM would interpret as 'foo' version '2-2', despite it being an invalid version according to PEP 440. This discrepancy can lead to arbitrary code execution during installation and facilitate downgrade attacks by merely altering the version number.
How To Fix
Minimum fixed version
2.20.0.post1+ds1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade pdmTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no known workarounds for this vulnerability other than upgrading to the patched version of PDM.
Conclusion
The identified vulnerability in the PDM package poses a significant risk to users by allowing malicious packages to be installed under the guise of trusted dependencies. It is imperative for users to upgrade to the latest patched version to mitigate these risks and ensure the integrity of their projects.
See every vulnerability recorded for pdm →
FAQ
The vulnerability allows for the installation of malicious packages by manipulating the 'pdm.lock' file, leading to potential arbitrary code execution.
If you are using PDM versions prior to 2.20.0.post1+ds1-1, your project may be vulnerable. You can check your version using the command 'pdm --version'.
While there are no workarounds, it is crucial to monitor your dependencies closely and consider using tools like Vulert to check for vulnerabilities in your project.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json. You can check your application for vulnerabilities in real-time without needing to install anything.
Detailed information can be found in the Debian CVE database or by visiting the official PDM repository for updates and patches.
References
Related vulnerabilities
Recent vulnerabilities recorded for pdm.
