CVE-2022-28470: Code Execution Backdoor in marcador package
Summary
CVE-2022-28470: marcador package in PyPI 0.1 through 0.13 included a code-execution backdoor. Affects marcador versions >= 0.1, < 0.14. Fixed in 0.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The marcador package is a Python package available on PyPI (Python Package Index) that provides functionality for creating and managing bookmarks. It is commonly used in web applications to allow users to save and organize their favorite links. The package versions 0.1 through 0.13 are affected by a code-execution backdoor vulnerability.
Vulnerability Detail
The marcador package versions 0.1 through 0.13 included a code-execution backdoor. This backdoor allows an attacker to execute arbitrary code on a system where the vulnerable package is installed. The backdoor was present in the package's codebase and could be triggered by specific actions or inputs. Exploiting this vulnerability could lead to unauthorized access, data breaches, or complete compromise of the affected system.
How To Fix
Minimum fixed version
0.14
This is the first release that contains the fix.
pip install --upgrade "marcador==0.14"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version (0.14 or later) to ensure the security of the application.
Conclusion
The marcador package versions 0.1 through 0.13 are affected by a code-execution backdoor vulnerability. To ensure the security of your application, it is crucial to update to version 0.14 or later, which fixes the vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for marcador →
FAQ
This vulnerability allows an attacker to execute arbitrary code on systems where the vulnerable marcador package is installed. This can lead to unauthorized access, data breaches, or complete compromise of the affected system.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. The playground allows you to analyze your Pipfile.lock without requiring access to the code or installation.
No, only versions 0.1 through 0.13 of the marcador package are affected. The vulnerability has been fixed in version 0.14 and later.
No, there is no known workaround for this vulnerability. It is essential to update to the fixed version (0.14 or later) to mitigate the risk.
You can update the marcador package to the fixed version (0.14 or later) using a package manager like pip. Run 'pip install --upgrade marcador' to install the latest secure version of the package.
