CVE-2022-42919Deserialization of Untrusted Data in Python

Severity
7.8HIGHNVD
OSV7.6
EPSS
0.0%
top 88.60%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedNov 7
Latest updateJul 11

Description

Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non-default configuration. The Python multiprocessing library, when used with the forkserver start method on Linux, allows pickles to be deserialized from any user in the same machine local network namespace, which in many system configurations means any user on the same machine. Pickles can execute arbitrary code. Thus, this allows for local user privilege escalation to the user that any forkserv

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages11 packages

NVDpython/python3.9.03.9.16+3
debiandebian/python2.7< pypy3 7.3.11+dfsg-1 (bookworm)
debiandebian/python3.9< pypy3 7.3.11+dfsg-1 (bookworm)
debiandebian/python3.11< pypy3 7.3.11+dfsg-1 (bookworm)

Also affects: Fedora 35, 36, 37

🔴Vulnerability Details

4
OSV
python3.5, python3.6, python3.7, python3.8, python3.9, python3.10, python3.11, python3.12 vulnerabilities2024-07-11
OSV
python3.9 vulnerabilities2023-02-27
GHSA
GHSA-hrxf-3584-q6p6: Python 32022-11-07
OSV
CVE-2022-42919: Python 32022-11-07

📋Vendor Advisories

7
Ubuntu
Python vulnerabilities2024-07-11
CISA ICS
Siemens SCALANCE XCM-/XRM-3002024-02-15
Ubuntu
Python vulnerabilities2023-02-27
Microsoft
Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non-default configuration. The Python multiprocessing library when used with the forkserver start me2022-11-08
Ubuntu
Python vulnerability2022-11-03