CVE-2022-21699: Execution with Unnecessary Privileges in ipython
Summary
CVE-2022-21699: Execution with Unnecessary Privileges in ipython. Affects ipython across 4 version ranges.
< 5.11
>= 6.0.0, < 7.16.3
>= 7.17.0, < 7.31.1
>= 8.0.0, < 8.0.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- ipython · Debian:11
The same CVE-2022-21699 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
IPython is an interactive command-line interface for Python that provides enhanced features and capabilities. It allows users to execute Python code interactively, access help documentation, and perform various data analysis tasks. However, a vulnerability has been discovered in IPython that allows for the execution of untrusted files in the current working directory (CWD), leading to arbitrary code execution and potential privilege escalation.
Vulnerability Detail
The vulnerability in IPython arises from its execution of untrusted files in the CWD. This means that if a malicious user can place a specially crafted file in the CWD, they can trick IPython into executing it. As a result, the malicious code will run with the privileges of the user running IPython, potentially allowing for unauthorized access, data theft, or other malicious activities. This vulnerability poses a significant risk to systems where IPython is used, as it can lead to the compromise of sensitive information or the entire system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 5.115.11pip install --upgrade "ipython==5.11" -
>= 6.0.0, < 7.16.37.16.3pip install --upgrade "ipython==7.16.3" -
>= 7.17.0, < 7.31.17.31.1pip install --upgrade "ipython==7.31.1" -
>= 8.0.0, < 8.0.18.0.1pip install --upgrade "ipython==8.0.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can avoid running IPython from directories where untrusted files may exist. By ensuring that the CWD does not contain any untrusted files, the risk of executing malicious code can be minimized. Additionally, users can manually inspect the files in the CWD before running IPython to ensure that no suspicious or untrusted files are present.
Conclusion
The vulnerability in IPython that allows for execution with unnecessary privileges poses a significant risk to systems where IPython is used. It is crucial to update IPython to the patched versions to mitigate this vulnerability and prevent potential unauthorized access or data theft. Additionally, users should exercise caution when running IPython from directories where untrusted files may exist. For further support on vulnerability remediation or any other security concerns, feel free to reach out to DevNack.com.
See every vulnerability recorded for ipython →
FAQ
This vulnerability allows an attacker to execute arbitrary code with the privileges of the user running IPython. This can lead to unauthorized access, data theft, or other malicious activities.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your version of IPython is affected by this vulnerability. Simply provide your Pipfile.lock file, and Vulert will analyze it for any known vulnerabilities, including this one.
At the time of this advisory, there are no known public exploits for this vulnerability. However, it is important to patch your IPython installation as soon as possible to prevent any potential exploitation.
While updating IPython to the patched versions is the recommended solution, you can also mitigate the vulnerability by avoiding running IPython from directories where untrusted files may exist. Additionally, manually inspecting the files in the CWD before running IPython can help minimize the risk.
For further support on vulnerability remediation or any other security concerns, you can reach out to info@devnack.com. The Devnack team is available to assist you in securing your systems and addressing any vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for ipython.
