CVE-2022-21797: Arbitrary Code Execution
The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the predispatch flag in Parallel() class due to the eval() statement.
Other sources
The package joblib from 0 and before 1.2.0 is vulnerable to Arbitrary Code Execution via the predispatch flag in Parallel() class due to the eval() statement.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2022-21797?
CVE-2022-21797 is classified as a high severity vulnerability due to the risk of arbitrary code execution.
How do I fix CVE-2022-21797?
To fix CVE-2022-21797, upgrade the joblib package to version 1.2.0 or higher.
What systems are affected by CVE-2022-21797?
CVE-2022-21797 affects joblib versions from 0 to 1.1.1, specifically those installed via pip and certain Linux distributions like Fedora and Debian.
What type of vulnerability is CVE-2022-21797?
CVE-2022-21797 is an arbitrary code execution vulnerability caused by the misuse of the eval() function in the joblib library.
Can CVE-2022-21797 be exploited remotely?
Yes, CVE-2022-21797 can be exploited remotely if an attacker can control the input parameters sent to the affected joblib function.