CVE-2022-21668
published 2022-01-10CVE-2022-21668: pipenv is a Python development workflow tool. Starting with version 2018.10.9 and prior to version 2022.1.8, a flaw in pipenv's parsing of requirements files…
PriorityP350high8.6CVSS 3.1
AVLACLPRNUIRSCCHIHAH
EPSS
3.90%
89.2th percentile
pipenv is a Python development workflow tool. Starting with version 2018.10.9 and prior to version 2022.1.8, a flaw in pipenv's parsing of requirements files allows an attacker to insert a specially crafted string inside a comment anywhere within a requirements.txt file, which will cause victims who use pipenv to install the requirements file to download dependencies from a package index server controlled by the attacker. By embedding malicious code in packages served from their malicious index server, the attacker can trigger arbitrary remote code execution (RCE) on the victims' systems. If an attacker is able to hide a malicious `--index-url` option in a requirements file that a victim installs with pipenv, the attacker can embed arbitrary malicious code in packages served from their malicious index server that will be executed on the victim's host during installation (remote code execution/RCE). When pip installs from a source distribution, any code in the setup.py is executed by the install process. This issue is patched in version 2022.1.8. The GitHub Security Advisory contains more information about this vulnerability.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | pipenv | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| pypa | pipenv | — | — |
| pypa | pipenv | >= 0 < 439782a8ae36c4762c88e43d5f0d8e563371b46f | 439782a8ae36c4762c88e43d5f0d8e563371b46f |
| pypa | pipenv | >= 2018.10.9 < 2022.1.8 | 2022.1.8 |
| pypa | pipenv | >= 2018.10.9 < 2022.1.8 | 2022.1.8 |
CVSS provenance
nvdv3.18.6HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vendor_debian8.0LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Pipenv's requirements.txt parsing allows malicious index url in comments
osv·2022-01-12
CVE-2022-21668 [HIGH] Pipenv's requirements.txt parsing allows malicious index url in comments
Pipenv's requirements.txt parsing allows malicious index url in comments
## Issue Summary
Due to a flaw in pipenv's parsing of requirements files, an attacker can insert a specially crafted string inside a comment anywhere within a requirements.txt file, which will cause victims who use pipenv to install the requirements file (e.g. with "`pipenv install -r requirements.txt`") to download dependencies from a package index server controlled by the attacker. By embedding malicious code in packages served from their malicious index server, the attacker can trigger arbitrary remote code execution (RCE) on the victims' systems.
### Impact
The impact of successful exploitation is **severe/critical**.
If an attacker is able to hide a malicious `--index-url` option in a requirements file that a
GHSA
Pipenv's requirements.txt parsing allows malicious index url in comments
ghsa·2022-01-12
CVE-2022-21668 [HIGH] CWE-20 Pipenv's requirements.txt parsing allows malicious index url in comments
Pipenv's requirements.txt parsing allows malicious index url in comments
## Issue Summary
Due to a flaw in pipenv's parsing of requirements files, an attacker can insert a specially crafted string inside a comment anywhere within a requirements.txt file, which will cause victims who use pipenv to install the requirements file (e.g. with "`pipenv install -r requirements.txt`") to download dependencies from a package index server controlled by the attacker. By embedding malicious code in packages served from their malicious index server, the attacker can trigger arbitrary remote code execution (RCE) on the victims' systems.
### Impact
The impact of successful exploitation is **severe/critical**.
If an attacker is able to hide a malicious `--index-url` option in a requirements file that a
OSV
CVE-2022-21668: pipenv is a Python development workflow tool
osv·2022-01-10
CVE-2022-21668 CVE-2022-21668: pipenv is a Python development workflow tool
pipenv is a Python development workflow tool. Starting with version 2018.10.9 and prior to version 2022.1.8, a flaw in pipenv's parsing of requirements files allows an attacker to insert a specially crafted string inside a comment anywhere within a requirements.txt file, which will cause victims who use pipenv to install the requirements file to download dependencies from a package index server controlled by the attacker. By embedding malicious code in packages served from their malicious index server, the attacker can trigger arbitrary remote code execution (RCE) on the victims' systems. If an attacker is able to hide a malicious `--index-url` option in a requirements file that a victim installs with pipenv, the attacker can embed arbitrary malicious code in packages served from their mal
Debian
CVE-2022-21668: pipenv - pipenv is a Python development workflow tool. Starting with version 2018.10.9 an...
vendor_debian·2022·CVSS 8.0
CVE-2022-21668 [HIGH] CVE-2022-21668: pipenv - pipenv is a Python development workflow tool. Starting with version 2018.10.9 an...
pipenv is a Python development workflow tool. Starting with version 2018.10.9 and prior to version 2022.1.8, a flaw in pipenv's parsing of requirements files allows an attacker to insert a specially crafted string inside a comment anywhere within a requirements.txt file, which will cause victims who use pipenv to install the requirements file to download dependencies from a package index server controlled by the attacker. By embedding malicious code in packages served from their malicious index server, the attacker can trigger arbitrary remote code execution (RCE) on the victims' systems. If an attacker is able to hide a malicious `--index-url` option in a requirements file that a victim installs with pipenv, the attacker can embed arbitrary malicious code in packages served from their mal
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/pypa/pipenv/commit/439782a8ae36c4762c88e43d5f0d8e563371b46fhttps://github.com/pypa/pipenv/releases/tag/v2022.1.8https://github.com/pypa/pipenv/security/advisories/GHSA-qc9x-gjcv-465whttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/56HBA3EOSLEDNCCBJVHE6DO34P56EOUM/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KCROBYHUS6DKQPCXBRPCZ5CDBNQTYAWT/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QHQRIWKDP3SVJABAPEXBIQPKDI6UP7G4/https://github.com/pypa/pipenv/commit/439782a8ae36c4762c88e43d5f0d8e563371b46fhttps://github.com/pypa/pipenv/releases/tag/v2022.1.8https://github.com/pypa/pipenv/security/advisories/GHSA-qc9x-gjcv-465whttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/56HBA3EOSLEDNCCBJVHE6DO34P56EOUM/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KCROBYHUS6DKQPCXBRPCZ5CDBNQTYAWT/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QHQRIWKDP3SVJABAPEXBIQPKDI6UP7G4/
2022-01-10
Published