Code Injection in py3-joblib - CVE-2022-21797

Vulnerability identifier: #VU72164

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-21797

CWE-ID: CWE-94

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists in the pre_dispatch flag in Parallel() class due to the eval() statement. A remote attacker can send a specially crafted request and execute arbitrary code on the target system.

py3-joblib
Oracle Business Intelligence Enterprise Edition
PowerStore T
IBM Watson Machine Learning Accelerator
Dell EMC PowerStore Family Operating System
Robotic Process Automation for Cloud Pak
Gentoo Linux
openEuler
Fedora
python-joblib
python3-joblib
dev-python/joblib

Install updates from vendor's website.

py3-joblib - update to 1.2.0
python-joblib - update to 0.14.0-4
python3-joblib - update to 0.14.0-4
dev-python/joblib - update to 1.2.0
python-joblib - addressed in versions 1.2.0-1.fc36, 1.2.0-1.fc37
PowerStore T - update to 3.6.1.2-2315284
IBM Watson Machine Learning Accelerator - update to 4.0
Dell EMC PowerStore Family Operating System - update to 4.0.0.0-2284811
Robotic Process Automation for Cloud Pak - update to 21.0.6

• https://github.com/joblib/joblib/commit/b90f10efeb670a2cc877fb88ebb3f2019189e059
• https://github.com/joblib/joblib/issues/1128
• https://github.com/joblib/joblib/pull/1321
• https://security.snyk.io/vuln/SNYK-PYTHON-JOBLIB-3027033
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BVOMMW37OXZWU2EV5ONAAS462IQEHZOF/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MJ5XTJS6OKJRRVXWFN5J67K3BYPEOBDF/
• https://lists.debian.org/debian-lts-announce/2022/11/msg00020.html

• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Gentoo update for Joblib
• Multiple vulnerabilities in IBM Watson Machine Learning Accelerator on Cloud Pak for Data
• openEuler update for python-joblib
• Multiple vulnerabilities in Dell PowerStore Family
• Multiple vulnerabilities in Oracle Business Intelligence Enterprise Edition
• Multiple vulnerabilities in Dell PowerStoreT OS
• Fedora 36 update for python-joblib
• Fedora 37 update for python-joblib